CVE-2026-61732 Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK Bring Your Own Key deployment model, users...

CVE-2026-94609

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate...

CVE-2026-91160

The OpenWA WhatsApp API gateway is vulnerable to an unauthorized information disclosure in versions prior to 0.23.5 . The /events WebSocket gateway improperly delivers the session.qr event to VIEWER API keys, even though access to the QR code via the REST API requires an OPERATOR role. This vulne...

SUSE CVE-2026-19072

Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although the field "compiledcollectorargs" is an internal field, Velociraptor allowed the field to be set from a user API call. This allows another user who...

EUVD-2026-86279

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate...

CVE-2026-94609

The open-source identity provider authentik is vulnerable to privilege escalation in versions prior to 2026.2.7, 2026.5.7, and 2026.8.2. An attacker with delegated permissions to manage groups, group memberships, or users can grant superuser status to an account or assign roles to a group without...

CVE-2026-94609 authentik: Privilege Escalation to Superuser via Group Hierarchy

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate...

CVE-2026-94609 authentik: Privilege Escalation to Superuser via Group Hierarchy

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate...

CVE-2026-94609 authentik: Privilege Escalation to Superuser via Group Hierarchy

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate...

CVE-2026-94613 authentik: Denial of Service via Document Type Declarations in SAML Messages

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling...

CVE-2026-94613 authentik: Denial of Service via Document Type Declarations in SAML Messages

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling...

CVE-2026-97311 Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-97311 Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This allows a delegated administrator with basic search privileg...

CVE-2026-97311

A flaw in the Admin REST API of Keycloak , an identity and access management solution, allows for unauthorized information disclosure. Specifically, endpoints used to retrieve groups associated with a specific role fail to properly verify individual group visibility permissions . This vulnerabili...

CVE-2026-89005

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session ...

CVE-2026-88843

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...

CVE-2026-89005

The WPeMatico RSS Feed Fetcher WordPress plugin, versions before 2.8.26 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to sanitize and escape specific campaign configuration fields when a particular feature is enabled. This allows users with the Contributor rol...

EUVD-2026-85807

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session ...

CVE-2026-89005 WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain feature is enabled, which allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the session ...

CVE-2026-88843

The MasterStudy LMS WordPress Plugin (versions before 3.7.50 ) contains a vulnerability where a display-style setting is not properly validated when building a template path. This flaw allows users with the Contributor role or higher to perform local file inclusion and execute arbitrary local PHP...