50098 matches found
CVE-2026-61440 PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints
PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to...
EUVD-2026-44622
Authorization Bypass Through User-Controlled Key CWE-639 in the Excel import handlers CustomerImport, LeadImport, ProductImport in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company...
MAL-2026-10680 Malicious code in syncgrove (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c96b3528ab792944d243b00ae61facc33740850b5cb2ed19671fd6732e43494 The package's postinstall lifecycle script contacts a hardcoded plain-HTTP endpoint at http://player.sweeprovider.org, retrieves a key via /getKey.ph...
Malicious code in ac-raf-emitter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a9d9e454c08fdafa531ee74a3bc52513d5bc39413810db4a6371494872984f8 package.json declares a preinstall lifecycle script that runs curl -X POST against a hardcoded webhook.site collector URL...
MAL-2026-10675 Malicious code in ac-raf-emitter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a9d9e454c08fdafa531ee74a3bc52513d5bc39413810db4a6371494872984f8 package.json declares a preinstall lifecycle script that runs curl -X POST against a hardcoded webhook.site collector URL...
Uncontrolled Resource Consumption
github.com/spectolabs/hoverfly is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to the use of http.DefaultClient without a configured timeout for remote post-serve actions, which allows an attacker to trigger requests to a non-responsive endpoint,...
CVE-2026-12281
creationtimestamp| type| source ---|---|--- 2026-07-15 08:23:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqoc76djrl22 2026-07-15 12:00:16+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqoockgock2y...
CVE-2026-12512
creationtimestamp| type| source ---|---|--- 2026-07-15 08:18:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqobw65kbh2w 2026-07-15 12:00:10+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqoocffj5p2e 2026-07-15 12:44:11+00:00| seen|...
CVE-2026-15583
creationtimestamp| type| source ---|---|--- 2026-07-15 08:17:28+00:00| seen| https://bsky.app/profile/suriq.io/post/3mqobu5nz4y2w 2026-07-17 16:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/93844 2026-07-17 22:00:05+00:00| published-proof-of-concept|...
CVE-2026-35152
creationtimestamp| type| source ---|---|--- 2026-07-15 06:55:57+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqo5cffab52h 2026-07-15 13:12:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqoseeru4y2c 2026-07-16 10:37:06+00:00| seen|...
CVE-2026-11580
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...
CVE-2026-11580 Kali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDOR
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...
EUVD-2026-44593
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...
CVE-2026-11580 Kali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDOR
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...
CVE-2026-11580
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...
CVE-2026-11580
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin, in versions prior to 2.4.17 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a missing per-object capability check in the plugin's post-duplication AJAX action . This allows users with Contrib...
Post-Quantum Cryptography: What’s Next for Edge Security
...
CVE-2026-31837
creationtimestamp| type| source ---|---|--- 2026-07-15 04:34:38+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqnvfpbgnk2w...