CVE-2026-52371

A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...

CVE-2026-52371: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request...

CVE-2026-12945 Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints...

CVE-2026-12945

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints...

EUVD-2026-50134

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception...

CVE-2026-63239

The CVE-2026-63239 entry describes a vulnerability in Koollab LMS where hard-coded AWS IAM credentials are present. This flaw can allow an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email...

PT-2026-65710

A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing sensitive data and enabling malicious content injection, job manipulation, or email interception...

WordPress Simple Job Board - Unauthorized Data Access Detection

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

Digital-Archiving-Solutions-v1.02-Remote-Code-Execution-POC

Digital-Archiving-Solutions-v1.02-Remote-Code-Execution-POC T...

CVE-2026-16798

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to stri...

CVE-2026-16798

The Devolutions PowerShell Universal software (versions 2026.2.2 and earlier ) contains a vulnerability in the automation jobs API where sensitive information is improperly included in sent data. Due to a failure to strip OAuth refresh tokens from job read responses, an authenticated user possess...

EUVD-2026-48605

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to stri...

CVE-2026-65917

CyberPanel through 1.9.1, fixed in commit b198460, contains an insecure direct object reference IDOR vulnerability in the IncBackups application's incremental-backup handlers deleteBackup, fetchRestorePoints, and restorePoint that allows authenticated panel users to access or manipulate other...

PraisonAI: Jobs API exposes agent-execution endpoints with no authentication

praisonai: Jobs API exposes agent-execution endpoints with no authenticationResearcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Target: https://github.com/MervinPraison/PraisonAI---Package: praisonai on PyPIAffected version empirically tested:...

CVE-2026-16544

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...

EUVD-2026-47629

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...

CVE-2026-16544

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...

CVE-2026-16544

AWX security issue: the websocket event consumer omits RBAC checks for inventory_update_events, project_update_events, and system_job_events, allowing any authenticated user to subscribe to these unmapped groups and view real-time stdout from jobs in other organizations. Affected component is the...

CVE-2026-16544

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumeraccess function jobevents, workflowevents, adhoccommandevents. Three event groups - inventoryupdateevents, projectupdateevents, and systemjobevents — are n...

PT-2026-63337

A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer access function job events, workflow events, ad hoc command events. Three event groups - inventory update events, project update events, and system job...