IAGA-Sentinel

IAGA Sentinel La capa de evidencia de conformidad con la Ley de IA de la UE para agentes de IA. Evidencia firmada criptográficamente y verificable mediante reproducción de cada acción que un agente enruta a través de ella, estructurada para respaldar el mantenimiento de registros del Artículo 12 ...

scopeblind-gateway

⚠️ Este repositorio se ha movido. El desarrollo activo continúa en ScopeBlind/scopeblind-gateway. Este fork personal podría estar detrás del repositorio canónico. Por favor, usa el repo de la organización para issues, pull requests y el código más reciente. protect-mcp Puerta de enlace de segurida...

scopeblind-gateway

protect-mcp Puerta de política Cedar de fallo cerrado más recibos firmados para llamadas a herramientas de agentes de IA. protect-mcp es una puerta que se sitúa delante de las llamadas a herramientas de un agente de IA. Evalúa cada llamada contra una política Cedar el mismo lenguaje que AWS usa...

device-activity-tracker

Device Activity Tracker WhatsApp & Signal Activity Tracker via RTT Analysis ⚠️ DISCLAIMER : Proof-of-concept for educational and security research purposes only. Demonstrates privacy vulnerabilities in WhatsApp and Signal. Overview This project implements the research from the paper "Careless...

scopeblind-gateway v0.13.1

protect-mcp Fail-closed Cedar policy gate plus signed receipts for AI agent tool calls. protect-mcp is a gate that sits in front of an AI agent's tool calls. It evaluates each call against a Cedar policy the same language AWS uses for IAM, blocks what breaks the rules before it runs, and signs an...

EUVD-2026-53719

The PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 does not verify that a requested attachment belongs to the order referenced by its access token, allowing unauthenticated attackers to forge a token and disclose image attachments, including other customers' uploaded payment...

CVE-2026-17567

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...

CVE-2026-17567

The CVE-2026-17567 entry affects the WordPress plugin Fluent Forms

CVE-2026-17567

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...

CVE-2026-14183

The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order...

CVE-2026-14183

The Classified Listing WordPress plugin versions before 5.3.9 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in its payment-receipt handler . The component fails to verify that the targeted order belongs to the requesting user. This allows authenticated users with subscriber-lev...

CVE-2026-14183 Classified Listing < 5.3.9 - Subscriber+ Payment Receipt Disclosure via IDOR

The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order...

CVE-2026-14183

The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order...

PT-2026-61836

The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order...

PT-2026-46113

Name of the Vulnerable Software and Affected Versions Drupal Commerce Core versions 3.3.0 through 3.3.6 Description Stored Cross-site Scripting XSS occurs due to improper neutralization of input during web page generation. The module fails to sufficiently sanitize customer comments within the ord...

CVE-2026-6451 CMS für Motorrad Werkstätten <= 1.0.0 - Cross-Site Request Forgery

The cms-fuer-motorrad-werkstaetten plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.0.0. This is due to missing nonce validation on all eight AJAX deletion handlers: vehiclescfmwdvehicle, contactscfmwdcontact, supplierscfmwdsupplier,...

WordPress plugin cms-fuer-motorrad-werkstaetten 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There ar...

Discourse Information Disclosure Vulnerability (CNVD-2026-17258)

Discourse is Discourse open source set of open source community discussion platform. The platform includes features such as community , e-mail and chat rooms . Discourse suffers from an information disclosure vulnerability that stems from non-employee users having access to read receipt informati...

CVE-2026-35468

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.historystore.historyindex.unwr...

CVE-2026-35468 nimiq/core-rs-albatross: Panic in history index request handlers when a full node runs without the history index

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, two peer-facing consensus request handlers assume that the history index is always available and call blockchain.historystore.historyindex.unwr...