63724 matches found
PT-2026-63950
Unauthenticated Cross Site Request Forgery CSRF in Kwayy HTML Sitemap = 4.0 versions...
PT-2026-63894
Unauthenticated Broken Access Control in Kit formerly ConvertKit = 3.3.5 versions...
PT-2026-64114
Summary Setting PRAISONAI CALL AUTH=disabled completely disables all authentication on the /api/v1/agents/id/invoke endpoint. This bypass is advertised in the application's own error messages, making it likely to appear in production Docker and Compose configurations. Details python...
PT-2026-64109
Unauthenticated Remote Code Execution via Jobs API and Approval Bypass in PraisonAI Summary An unauthenticated attacker can execute arbitrary OS commands on any server running the PraisonAI Jobs API by submitting a crafted workflow YAML. The attack chains two weaknesses: the /api/v1/runs endpoint...
PT-2026-63860
Unauthenticated Broken Access Control in WPDM – Premium Packages = 6.2.0 versions...
PT-2026-63862
Unauthenticated Insecure Direct Object References IDOR in Easy Appointments = 3.12.27 versions...
PT-2026-63572
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the user has cap filter in the SRP REST Earning Controller class unconditionally...
PT-2026-63591
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...
PT-2026-63787
The MDJM Event Management plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8.4. This is due to missing capability checks and nonce verification in the MDJM Permissions::set permissions and MDJM Employee Manager::init functions, combined with the...
The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform allows a perpetrator to gain full control over the application.
The vulnerability of the Content Server component of the Oracle WebCenter Content user interaction platform relates to the absence of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using...
The vulnerability of the Security Framework component of the Oracle WebCenter Portal web platform allows a perpetrator to gain full control over the application.
The vulnerability of the Security Framework component of the Oracle WebCenter Portal is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control over the application using the HTTPS...
PT-2026-63896
Unauthenticated Sensitive Data Exposure in Ninja Tables = 5.2.10 versions...
PT-2026-63848
Unauthenticated Broken Authentication in Easy Digital Downloads = 3.6.7 versions...
PT-2026-63906
Unauthenticated Broken Access Control in Content Control = 2.6.5 versions...
PT-2026-63818
Unauthenticated Broken Access Control in YT Player = 2.0.9 versions...
PT-2026-63936
Unauthenticated Broken Access Control in Civi Framework = 2.2.0 versions...
PT-2026-63940
Unauthenticated Broken Access Control in Graphina = 3.1.12 versions...
PT-2026-64038
Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary filesystem locations and read conversation metadata from outside the intended...
PT-2026-64028
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint...