12693 matches found
CVE-2026-3431 Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion
On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including...
CVE-2026-3431 Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion
On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including...
Sim Studio security vulnerabilities
Sim Studio is an open-source AI agent workflow builder developed by Sim Studio. Versions of Sim Studio prior to 0.5.74 contained security vulnerabilities. These vulnerabilities stemmed from authorization checks bypassed in the/api/auth/oauth/token endpoint, which could allow unverified attackers ...
Sim Studio security vulnerabilities
Sim Studio is an open-source AI agent workflow builder developed by Sim Studio. Versions of Sim Studio prior to 0.5.74 contained security vulnerabilities. These vulnerabilities stemmed from MongoDB tool endpoints accepting arbitrary connection parameters, which could allow unauthorized access to...
Studio Fabryka DobryCMS code-related vulnerabilities
Studio Fabryka DobryCMS is a content management system developed by Studio Fabryka. Versions of Studio Fabryka DobryCMS prior to version 5.0 had code vulnerabilities. These vulnerabilities stemmed from defects in the file upload functionality, which could lead to remote code execution...
Fabryka Studio has a SQL injection vulnerability
Studio Fabryka DobryCMS is a content management system developed by Studio Fabryka. Versions of Studio Fabryka DobryCMS prior to version 8.0 had a SQL injection vulnerability. This vulnerability stemmed from SQL injections in URL paths, which could lead to blind injection attacks...
Visual Studio Code Live Server Unauthorized Access
The vulnerability of the Live Server extension of the Visual Studio Code editor relates to the lack of protective measures for website structures. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information through a specially created HTML page...
Visual Studio Code Markdown Preview Enhanced Code Execution
The vulnerability of the Visual Studio Code Markdown Preview Enhanced editor extension is related to improper handling of code generation. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading a specially created file with the extension .Md...
Security Bulletin: Vulnerability in IBM® Java SDK affects WebSphere Service Registry and Repository due to CVE-2026-1188
Summary A buffer overflow vulnerability in IBM® SDK, Java™ Technology Edition affects IBM WebSphere Service Registry and Repository. This issue is also addressed by WebSphere Application Server shipped with WebSphere Service Registry and Repository. Vulnerability Details CVEID:CVE-2026-1188...
MAL-2026-1020 Malicious code in @ai-studio-web/app (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a29e5e23697b695bdd456d100ba49a1ef5c6f4450b46672dedcd164a073e8eb The package @ai-studio-web/app was found to contain malicious code. Source: ghsa-malware...
Malicious code in @ai-studio-web/app (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a29e5e23697b695bdd456d100ba49a1ef5c6f4450b46672dedcd164a073e8eb The package @ai-studio-web/app was found to contain malicious code. Source: ghsa-malware...
kyoukai (>=2.2.0, <=2.2.1), mezmorize (>=0.18.1, <=0.25.0) +2 more potentially affected by CVE-2026-27199 via werkzeug (0.13.0)
werkzeug PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - kyoukai =2.2.0, =0.18.1, =0.49.2, =0.0.0.1, =0.0.3 Source cves: CVE-2026-27199 Source advisory: OSV:PYSEC-2026-2320...
kyoukai (>=2.2.0, <=2.2.1), mezmorize (>=0.18.1, <=0.25.0) +2 more potentially affected by CVE-2026-27199 via werkzeug (0.13.0)
werkzeug PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - kyoukai =2.2.0, =0.18.1, =0.49.2, =0.0.0.1, =0.0.3 Source cves: CVE-2026-27199 Source advisory: OSV:GHSA-29VQ-49WR-VM6X...
📄 Sawtooth Lighthouse Studio 9.16.14 Remote Command Execution
Sawtooth Lighthouse Studio version 9.16.14 proof of concept remote command execution exploit. ============================================================================================================================================= | Title : Sawtooth Lighthouse Studio 9.16.14 RCE | | Author :...
Critical Flaws Found in Four VS Code Extensions with Over 125 Million Installs
Cybersecurity researchers have disclosed multiple security vulnerabilities in four popular Microsoft Visual Studio Code VS Code extensions that, if successfully exploited, could allow threat actors to steal local files and execute code remotely. The extensions, which have been collectively...
Remote Code Execution via Flow Studio Node Definitions
Description LOLLMS Flow Studio contains multiple code execution vulnerabilities via unsafe use of Python's exec function. Two distinct code paths allow arbitrary Python code execution on the server: 1. Direct Code Execution via/api/flows/testcode Admin endpoint File: backend/routers/flowstudio.py...
ABB B&R Automation Studio
SUMMARY ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is available that replaces an outdated third-party component. Although no successful exploitation was observed during testing of the affected B&R products, the identified...
WordPress Plugin 'LA Studio Element Kit for Elementor' < 1.6.0 Unauthenticated Privilege Escalation via Backdoor
The WordPress application running on the remote host has a version of the 'LA Studio Element Kit for Elementor' plugin that is prior to 1.6.0. It is, therefore, affected by an unauthenticated privilege escalation vulnerability. The plugin contains a backdoor that allows unauthenticated attackers ...
