47304 matches found
CVE-2026-45018: Improper Neutralization of Special Elements used in an OS Command
Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...
CVE-2026-77140: Missing Authorization
The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite...
The vulnerability of the register.php component in the phpMyFAQ web application allows a hacker to circumvent existing security restrictions.
The vulnerability of the register.php component in the phpMyFAQ web application is related to the lack of authentication when processing the security.enableRegistration parameter. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions by sending a speciall...
PT-2026-81271
The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and...
CVE-2026-19943: Improper Neutralization of Input During Web Page Generation
The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-55541: Missing Authorization
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but createagentsapp and createunifiedapp do not install a credential check. Unauthenticated callers can reach POST /agents and POST /api/v1/agents/id/invoke. This...
CVE-2026-55538: Missing Authentication for Critical Function
PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, praisonai serve agents parses config"apikey" but createagentsapp does not authenticate POST /agents or POST /agents/agentname. Missing or incorrect bearer and X-API-Key values still reach agent execution. This issue is fixed in...
CVE-2026-77337
creationtimestamp| type| source ---|---|--- 2026-08-24 23:20:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtugwwvdb72p 2026-08-25 00:08:06+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtujmtqa4j24 2026-08-25 01:12:31+00:00| seen|...
CVE-2026-32555
creationtimestamp| type| source ---|---|--- 2026-08-24 23:00:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtuftb6did2m 2026-08-25 00:07:42+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtujlzxlnb25 2026-08-25 01:12:41+00:00| seen|...
CVE-2026-78434
A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::postticketreply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be...
CVE-2026-32563
Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-78266
creationtimestamp| type| source ---|---|--- 2026-08-24 22:14:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ahzqsf6v2jvpj...
CVE-2026-19568
creationtimestamp| type| source ---|---|--- 2026-08-24 22:02:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtucllupjp2l...
CVE-2026-32563 WordPress ACPT (Pro) - Custom Post Types Plugin for WordPress plugin <= 2.0.63 - PHP Object Injection vulnerability
Subscriber PHP Object Injection in ACPT Pro - Custom Post Types Plugin for WordPress = 2.0.63 versions...
CVE-2026-32563
CVE-2026-32563 is a PHP Object Injection vulnerability in the ACPT (Pro) – Custom Post Types Plugin for WordPress , affecting versions ≤ 2.0.63 . The vulnerability requires Subscriber -level access as stated in the description, though the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates Pr...
CVE-2026-78434
Faveo Helpdesk versions up to 2.0.3 contain a missing authentication flaw in the FormController::post_ticket_reply function within app/Http/Controllers/Client/helpdesk/FormController.php, specifically in the post-ticket-reply Endpoint . An unauthenticated remote attacker can exploit this to achie...
CVE-2026-78434 Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication
A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::postticketreply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be...
CVE-2026-78434 Faveo Helpdesk post-ticket-reply Endpoint FormController.php post_ticket_reply missing authentication
A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::postticketreply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be...
OPENSUSE-SU-2026:21634-1 Security update for liboqs
This update for liboqs fixes the following issues: Changes in liboqs: Updated to 0.16.0: Deprecation notice: - SPHINCS+ was removed in 0.16.0. Security issues: - Fixed uninitialized encapsderand pointer dereference - CVE-2026-46344, CVE-2026-44518: Fixed out-of-bounds read in XMSS/XMSS^MT signatu...