CVE-2026-66138

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntpserver is passed to a shell...

CVE-2026-66138

OpenStack Ironic Python Agent (up to 11.6.0) is affected. A project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent by supplying a malicious configuration that causes the ntp_server value to be passed to a shell. The vulnerability allows rem...

CVE-2026-66138

In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntpserver is passed to a shell...

PT-2026-64262

In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment...

PT-2026-64241

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue...

CVE-2026-55730: Improper Neutralization of Input During Web Page Generation

Reflected Cross-Site Scripting CWE-79 in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious project or...

CVE-2026-12877: Improper Authentication

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before 5.1.0 does not sanitise and escape user supplied input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the Project Management, Bug and Issue...

PT-2026-64232

Name of the Vulnerable Software and Affected Versions OpenStack Ironic Python Agent versions prior to 11.6.1 Description A project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent. This occurs because the value of the ntp server variable is...

A New Threat Landscape Meets A New Kind of Defender

Three years ago we launched a bug bounty program to accelerate WordPress security research, and it has been incredibly successful and has since secured the WordPress community against 9,727 vulnerabilities reported through our program. We have thus far awarded a total of $981,251 to researchers...

EUVD-2026-48252

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open...

CVE-2026-64806

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter...

CVE-2026-64809

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter...

CVE-2026-64811

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration...

CVE-2026-64807

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration...

CVE-2026-64808

In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling...

CVE-2026-64802

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration...

CVE-2026-64804

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling...

CVE-2026-64805

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling...

CVE-2026-64803

In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK...

PraisonAI Code agent tools fail open without a workspace boundary

PraisonAI Code agent tools fail open without a workspace boundary SummaryPraisonAI Code's agent-compatible CODETOOLS wrappers keep a global workspace root initialized to None. If an application uses CODETOOLS, codereadfile, codesearchreplace, or codeapplydiff before calling setworkspace, the...