garminconnect Has Insecure Permission Assignment for Garmin OAuth Token Store

Insecure Permission Assignment for Garmin OAuth Token Store Summarygarminconnect ≤ 0.3.4 wrote its OAuth token store to disk without restricting file-system permissions. Under the default Linux umask 022 the token file garmintokens.json was created world-readable 0o644. The file contains the DI...

PYSEC-2026-3524 praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery

praisonai-platform: default JWT signing secret dev-secret-change-me Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai-platform on PyPI Latest version and version tested: 0.1.4,...

praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

- Affected: praisonai-platform PyPI CWE-287 Improper Authentication OverviewGHSA-3qg8-5g3r-79v5 Critical reported that praisonai-platform's JWT signing secret defaulted to the hardcoded literal "dev-secret-change-me", and that the production guard meant to prevent this was default-open it only...

PYSEC-2026-3525 praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)

Affected: praisonai-platform PyPI CWE-287 Improper Authentication Overview GHSA-3qg8-5g3r-79v5 Critical reported that praisonai-platform's JWT signing secret defaulted to the hardcoded literal "dev-secret-change-me", and that the production guard meant to prevent this was default-open it only...

PYSEC-2026-3523 PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)

The WhatsApp and Linear bot adapters verify the inbound webhook HMAC signature only when a secret is configured. When the secret environment variable is unset — the default on a fresh install and common in development — verification is skipped entirely and the webhook body is parsed and dispatche...

CVE-2026-65501

CVE-2026-65501 affects the WordPress plugin Shiptastic for WooCommerce (versions

CVE-2026-65463

CVE-2026-65463 affects the WordPress Masteriyo LMS plugin, versioned up to 2.3.1, with an Insecure Direct Object References (IDOR) vulnerability in Subscriber scope. The entry provides a CVSS 3.1 base score of 5.4 (Medium) with network attack vector, low attack complexity, and requires low privil...

EUVD-2026-48075

Subscriber Insecure Direct Object References IDOR in Masteriyo - LMS = 2.3.1 versions...

EUVD-2026-48221

Contributor Insecure Direct Object References IDOR in Product Slider for WooCommerce = 1.13.62 versions...

CVE-2026-65456 WordPress Product Slider for WooCommerce plugin <= 1.13.62 - Insecure Direct Object References (IDOR) vulnerability

Contributor Insecure Direct Object References IDOR in Product Slider for WooCommerce = 1.13.62 versions...

CVE-2026-61946 WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...

EUVD-2026-48204

Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...

CVE-2026-61946 WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...

SUSE-SU-2026:22918-1 Security update for gzip

This update for gzip fixes the following issue - CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in a user's PATH bsc1269622...

EUVD-2026-47900

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 7.0.4 via the wpdmppdl parameter. This is due to the download function — hooked to the unauthenticated WordPress wp action — decoding the...

CVE-2026-65713 Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension

Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories...

CVE-2026-65713 Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension

Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories...

CVE-2026-65754 Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension

Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory...

CVE-2026-65712 Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension

Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata...

PT-2026-64126

praisonai-platform: default JWT signing secret dev-secret-change-me Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI --- Package: praisonai-platform on PyPI Latest version and version tested: 0.1.4,...