13513 matches found
CVE-2026-7362 Improper Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway
IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user...
Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
Summary The authentication rate limiter used for the login and two-factor checkpoint endpoints applies a single global bucket shared by every client, instead of keying per IP or per account. An unauthenticated attacker sending 10 requests per minute from one IP exhausts the shared bucket and caus...
Vulnera
Strix The open-source AI pentesting tool. Autonomous AI h...
CVE-2026-46428
A flaw was found in lettre, a mailer library for Rust. An inverted-boolean bug in the boring-tls integration silently disables TLS hostname verification for users employing the default strict configuration. A remote on-path attacker can exploit this by presenting any valid TLS certificate, allowi...
CVE-2026-15025 Uncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automatorgooglecontactsfetchlabels, automatormauticsegmentfetch, automatormautictagsfetch, and...
CVE-2026-15025
The Uncanny Automator WordPress plugin (up to version 7.3.2) is affected by Missing Authorization via four AJAX endpoints (ajax_fetch_labels, segments_fetch, tags_fetch, render_contact_fields). The issue stems from missing capability checks and nonce verification in the handlers, allowing authent...
kobra
KOBRA — Pemindai Kerentanan Web untuk Semua KOBRA adalah alat...
CVE-2026-18028 Missing authorization check in event quick setup view
The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...
Root-My-Device-Payloads
Root My Device Payloads A fork of BuSung-dev/Root-My-Galaxy-...
CVE-2026-16587 Advanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-16587
Technical details for CVE-2026-16587 are not publicly available in the provided documents. Monitor for updates.
EUVD-2026-49695
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-16587 Advanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-16587
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
ironclaw ironclaw-v1.0.0
IronClaw Your secure personal AI assistant, always on your side English | 简体中文 | Русский | 日本語 | 한국어 Reborn Quick Start • Philosophy • Features • Installation • Configuration • Security • Architecture IronClaw Reborn Quick Start IronClaw Reborn is the standalone runtime on the reborn-integration...
CVE-2026-16587: Missing Authorization
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
PT-2026-65399
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-15025: Missing Authorization
The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automatorgooglecontactsfetchlabels, automatormauticsegmentfetch, automatormautictagsfetch, and...
PT-2026-65546
Name of the Vulnerable Software and Affected Versions pytonapi versions 2.0.0 through 2.2.0 Description TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered using the path argument. During the setup process, bearer tokens are only stored under...
Malicious Package
Overview pfp-integration-mobile-heading is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...