CVE-2026-93901: Improper Privilege Management

The Optima Express IDX plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 8.7.5. This is due to the provisionBlogCredentials function in iHomefinderAdmin.php being reachable via the wpajaxnoprivihfclearcache AJAX action — through the call chain...

CVE-2026-93364: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and...

PT-2026-99094

A vulnerability was determined in krayin laravel-crm up to 2.2.5. This affects an unknown part of the file packages/Webkul/Admin/src/Http/Controllers/Settings/UserController.php of the component User Management. Executing a manipulation of the argument role id can lead to improper privilege...

WordPress Optima Express IDX plugin <= 8.7.5 - Unauthenticated Privilege Escalation to 'ihf_clear_cache' AJAX Action to Author Role Assignment vulnerability

Unauthenticated Privilege Escalation to 'ihfclearcache' AJAX Action to Author Role Assignment vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Optima Express + MarketBoost IDX Plugin versions = 8.7.5...

GHSA-G5F9-3XFG-P9MF Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Summary Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users configure their own LLM credentials to any OpenAI-compatible...

CVE-2026-52853

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

CVE-2026-52853 Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

CVE-2026-52853

The open-source collaborative wiki software Docmost is vulnerable to privilege escalation prior to version 0.90.1 . An authenticated workspace ADMIN can bypass role ceilings within the workspace invitation flow to invite an external email address with OWNER permissions. This flaw allows an ADMIN ...

CVE-2026-52853 Docmost: Privilege Escalation - ADMIN Can Invite Users as OWNER

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

EUVD-2026-86391

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspace invitation flow to invite an external email address with the OWNER role because the role ceiling does not prevent ADMIN users from granting privileges abov...

CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...

CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...

CVE-2026-61732

Versions prior to 1.1.17 of Decepticon , an autonomous hacking agent, are vulnerable to a role-boundary forgery because they fail to neutralize ChatML special-token literals when wrapping web crawl results into LLM messages. When using the BYOK deployment model with common providers (such as vLLM...

CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...

CVE-2026-94609

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate...

CVE-2026-91160

The OpenWA WhatsApp API gateway is vulnerable to an unauthorized information disclosure in versions prior to 0.23.5 . The /events WebSocket gateway improperly delivers the session.qr event to VIEWER API keys, even though access to the QR code via the REST API requires an OPERATOR role. This vulne...

SUSE CVE-2026-19072

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

CVE-2026-94609 authentik: Privilege Escalation to Superuser via Group Hierarchy

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate...

CVE-2026-94609 authentik: Privilege Escalation to Superuser via Group Hierarchy

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate...