49456 matches found
EUVD-2026-52589
The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the...
CVE-2026-18719
creationtimestamp| type| source ---|---|--- 2026-08-04 04:12:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/bhk7ad4rhbx7r...
CVE-2026-69096
creationtimestamp| type| source ---|---|--- 2026-08-04 04:05:00+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3msa533lecw2m...
EUVD-2026-52566
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...
CVE-2026-6837
A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...
CVE-2026-68981
creationtimestamp| type| source ---|---|--- 2026-08-04 01:52:04+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3ms7vng7zoz24 2026-08-06 11:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msfvlqyojt2q...
CVE-2026-69095
creationtimestamp| type| source ---|---|--- 2026-08-04 00:01:21+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3ms7phgudky2g...
CVE-2026-15233: Improper Neutralization of Input During Web Page Generation
The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the...
PT-2026-67652
The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the...
When Agents Learn to Be You: Benchmarking Privacy Leakage, Impersonation Risk, and Defenses in Persona Skills
Persona skills distill personal interaction histories into portable and executable artifacts for downstream agents. While enabling flexible personalization, this process concentrates fragmented personal signals, amplifies their impact through reuse, and challenges defenses designed for individual...
CVE-2026-16069: Improper Neutralization of Input During Web Page Generation
The Brizy WordPress plugin before 2.8.19 does not sanitize or escape featured-image focal-point coordinates submitted through one of its AJAX actions before storing them and later echoing them into HTML attributes in the post editor's Featured Image meta box, allowing users with the Contributor...
Post-Hoc Trajectory-Risk Certification for Modular LLM-Based Security Agents
Autonomous security agents operate as staged pipelines, such as classifying network traffic and then attributing attacks to a specific technique. Split conformal prediction gives each stage finite-sample coverage, but deployment requires a trajectory-level guarantee across the full chain. These...
CVE-2026-69250: Authorization Bypass Through User-Controlled Key
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...
CVE-2026-69258: Authorization Bypass Through User-Controlled Key
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowData objects in...
CVE-2026-70588: Improper Neutralization of Input During Web Page Generation
Ghost is a Node.js content management system. From 5.26.0 until 6.54.1, the Universal Import feature in Ghost Admin failed to properly sanitize imported content resulting in XSS in post content. This issue is fixed in version 6.54.1...
PT-2026-67930
Summary The OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is in WHITELIST URLS, meaning it requires no authentication. It decrypts the stored credential containing clientId, clientSecret, refresh token, sends a refresh request to the configured OAuth provider,...
PT-2026-67906
Summary Flowise's CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis which on Node.js exposes eval and dynamic import, the...
CVE-2026-70478: Exposure of Sensitive Information to an Unauthorized Actor
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the POST /api/v1/oauth2-credential/refresh/:credentialId endpoint is included in WHITELISTURLS and requires no authentication. The endpoint decrypts the stored credential, sends a refresh...
AI Forensics across White-, Grey-, and Black-Box Access: A Process Model and Research Agenda for Post-Incident Investigation of AI Systems
AI systems are increasingly involved in decisions and actions that may later require investigation. When an AI related incident occurs, investigators need to reconstruct what the system did, why it behaved that way, and which part of the system or supply chain contributed to the outcome. Existing...