9Router <= 0.4.36 - Unauthenticated RCE

9Router = 0.4.36 middleware only guards 8 explicitly listed routes, leaving /api/cli-tools/ and /api/mcp/ entirely unauthenticated. An attacker can POST to /api/cli-tools/cowork-settings to register a custom MCP plugin with attacker-controlled command and args stored verbatim into globalThis, the...

EUVD-2026-64155

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited...

SimpleHelp <= 5.5.7 - Privilege Escalation

SimpleHelp remote support software v5.5.7 and before contains a privilege escalation caused by insufficient access controls in API key creation, letting low-privileges technicians escalate privileges to server admin, exploit requires low-privileges technician access. id: CVE-2024-57726 info: name...

Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run...

CVE-2026-15580

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6...

CVE-2026-15580

N-able PassPortal browser extension (Chrome and Edge) is vulnerable to vault token disclosure via an unvalidated postMessage handler. Any site or iframe presented to the user could gain complete, persisted access to the decrypted vault for up to 100 days, enabling authentication abuse. The issue ...

EUVD-2026-63972

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6...

CVE-2026-15580 PassPortal browser extension: vault token disclosure via unvalidated postMessage

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6...

CVE-2026-69183

Monkeytype (a typing test application) versions 26.26.0 and earlier contain a rate-limit bypass in the backend key generator (backend/src/middlewares/rate-limit.ts). The generator prioritizes client-controlled cf-connecting-ip and x-forwarded-for headers over the trust-proxy-derived req.ip, allow...

EUVD-2026-63397

Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick 1 to solve it. 1...

ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On-Device Fraud

Cybersecurity researchers have shed light on an updated version of ToxicPanda aka TgToxic that comes with "significant enhancements," including a set of 167 remote commands and expands its targeting footprint globally. Zimperium zLabs, in a Wednesday report, said the Android malware also features...

CVE-2026-76349

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language SPL commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access...

CVE-2026-19875

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain an authentication bypass in the POST /api/v2/registration/ endpoint (CWE-306). An unauthenticated remote attacker can overwrite the server's registered admin email address and trigger outbound telemetry calls, enabling the instance to be abus...

BIT-ELK-2026-72680 Authorization Bypass Through User-Controlled Key in Kibana Agent Builder Leading to Unauthorized Data Modification

Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that identifier does not distinguish between a conversation that does not exist and one that exists but belongs to another user. As a result, an...

CVE-2026-52817 Linuxfabrik Monitoring Plugins Sudoers: /usr/bin/apt-get arguments allow privilege escalation

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems. Prior to version 5.1.0, the shipped assets/sudoers/Debian.sudoers policy allowed the nagios or icinga account to execute /usr/bin/apt-get as root without restricting its arguments. An attacker who...

EUVD-2026-61141

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedbackmessagemessage is stored without sanitization and rendered in app/views/admin/feedbackmessages/feedbackmessage.html.erb through...

CVE-2026-61696

Forem versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c render unsanitized feedback_message[message] via raw() in app/views/admin/feedback_messages/_feedback_message.html.erb, enabling stored XSS when an admin views an abuse report. The unauthenticated FeedbackMessagesController acc...

CVE-2026-75827

Grav before 2.0.15 uses an incomplete denylist in Blueprint dynamic-data validation, allowing attackers with page-edit or blueprint-config access to invoke error_log via a data directive and append PHP payloads to web-accessible files, achieving remote code execution. CVSS 4.0 score is 9.3 (CRITI...

CVE-2026-74908

Grav plugin-api before version 1.0.15 has a script injection flaw: its SVG sanitizer checks only the exact extension "svg", so attackers with api.media.write permission can upload .svgz or .xhtml files with script payloads that bypass sanitization and execute in the site origin when accessed. CVS...

GHSA-J6GC-4893-QWMP New API: Redis user quota cache overwrite via PUT /api/user/self allows quota bypass

Summary Authenticated users can repeatedly call PUT /api/user/self with language or sidebarmodules while relay requests are consuming quota. The settings path reads a full User snapshot and writes it back through User.Update, which refreshes Redis with RedisHSetObj and overwrites the Quota field...