CVE-2026-85081: Improper Neutralization of Input During Web Page Generation

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

PT-2026-99241

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 8.0.5 Description An issue exists where unauthenticated users can download database backup archives. In certain scenarios, these archives are saved using a fixed filename, enabling attackers to...

PT-2026-99312

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.8.4 Description Stored flashcard block content is not HTML-escaped before being interpolated into the card-manager list markup. Content returned by the '/api/riff/getRiffCards' endpoint is inserted into a template in...

PT-2026-99282

Name of the Vulnerable Software and Affected Versions Capgo versions prior to 12.261.1 Description The backend improperly restricts the roles that the apikey manager organization role can assign to new API keys. When an authenticated user with apikey manager permissions specifically org.manage...

CVE-2026-100673: Improper Neutralization of Input During Web Page Generation

The Grav Data Manager plugin getgrav/grav-plugin-datamanager versions 1.0.1 through 1.4.4 render stored data entries in the item-detail view admin/templates/partials/item.html.twig without escaping, applying Twig's raw filter — in some cases after a striptags' ' call that PHP's striptags bypasses...

CVE-2026-19708: Exposure of Sensitive Information to an Unauthorized Actor

The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and...

PT-2026-99245

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 8.0.5 FileOrganizer WordPress plugin versions prior to 1.2.1 File Manager Pro WordPress plugin versions prior to 2.1.3 Description These plugins fail to correctly validate the origin of window...

PT-2026-99286

Name of the Vulnerable Software and Affected Versions capgo.app versions prior to 12.267.1 Description Insufficient validation of API key privileges during the rotation process allows a user with the apikey manager role to rotate a sibling key belonging to a higher-privileged org super admin. By...

PT-2026-99344

Name of the Vulnerable Software and Affected Versions Grav Data Manager versions 1.0.1 through 1.4.4 Description Stored data entries in the item-detail view admin/templates/partials/item.html.twig are rendered without proper escaping due to the use of Twig's raw filter. In certain instances, a...

CVE-2026-100524: Cross-Site Request Forgery (CSRF)

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in the extensions manager that allows attackers to perform state-changing actions without anti-CSRF token validation. Attackers can craft links or embed images to force administrators to install, update, pause, or unpause...

PT-2026-99150

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0 Description The extensions manager lacks anti-CSRF token validation, leading to a cross-site request forgery issue. This allows authenticated administrators to be tricked into visiting a malicious page, where crafted link...

Exploit for Improper Verification of Cryptographic Signature in Wso2 Api_Control_Plane

abraxaslabs.tech · github.com/abraxas ·&...

CVE-2026-100192

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

EUVD-2026-87253

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

CVE-2026-100192 X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

CVE-2026-100192

X-SpringBoot versions through 6.0 are vulnerable to credential exposure via the GET /application/manager/select endpoint. The root cause is a lack of authentication and field filtering , allowing unauthenticated attackers to retrieve appKey and appSecret credentials. Successful exploitation enabl...

CVE-2026-100192 X-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint

X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...

CVE-2026-91837

A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters special characters that can execute...

UBUNTU-CVE-2026-91837

A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters special characters that can execute...

CVE-2026-91837

A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters special characters that can execute...