PT-2026-70835

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action...

Metabase 0.63.4 SQL Injection

A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability allows an attacker-controlled user-id value supplied to the password reset endpoint to reach a HoneySQL query as raw SQL. On installations using the default embedded H2...

PT-2026-70264

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference IDOR that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action...

PT-2026-70798

Name of the Vulnerable Software and Affected Versions PeerTube versions prior to 8.1.6 Description An issue exists in the ActivityPub-federated video streaming platform where the updateScore function in ActorFollowModel interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL...

PT-2026-70235

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email verified" claim and do not actually verify the email. This allows a user to...

PT-2026-70174

n8n before 2.32.1 and before 2.31.5 is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's...

CVE-2026-51584

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...

PT-2026-70209

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth service.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject...

PT-2026-70816

Name of the Vulnerable Software and Affected Versions Adobe Commerce affected versions not specified Magento Open Source affected versions not specified Adobe Commerce B2B affected versions not specified Description Stored Cross-Site Scripting XSS occurs due to insufficient protection of the web...

CVE-2026-72917

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-72917 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-72917

AnythingLLM up to version 1.15.0 has an account-recovery weakness in the unauthenticated recovery flow (server/utils/PasswordRecovery/index.js). The code uses recoverAccount() to deduplicate recoveryCodes before trimming, allowing a valid code submitted twice with different surrounding whitespace...

CVE-2026-72917

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-72917 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

GHSA-P9J2-GV94-2WF4

creationtimestamp| type| source ---|---|--- 2026-08-10 19:39:37+00:00| seen| https://gist.github.com/klemmanton-lgtm/8b54bdd2fe9905dc89b9c8ccf42f5fc4 2026-08-10 19:39:38+00:00| seen| https://gist.github.com/klemmanton-lgtm/4a24aedae8017b5aebed0300d07c7ee9 2026-08-17 10:21:36+00:00| seen|...

CVE-2026-72871

Dokploy (PaaS) vulnerability CVE-2026-72871: Before version 0.29.13, the unauthenticated /api/providers/github/setup route in Dokploy trusts gh_init organizationId and userId from the state and calls createGithub, enabling an attacker to insert a GitHub App provider containing client_secret, webh...

CVE-2026-72871

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts ghinit organizationId and userId values from the state parameter and calls createGithub in...

Myndr: CORS Misconfiguration / Broken Access Control

A CORS misconfiguration was discovered on the admin panel that allowed any website hosted on a subdomain of the target organization to read authenticated admin responses, including CSRF nonces and session data. This vulnerability could have enabled full admin account takeover through a CSRF attac...

WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability

Account Takeover vulnerability discovered by Denver Jackson in WordPress Theme Cartify versions = 1.3.0.1...

CVE-2026-18469

The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will...