LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release

LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hu...

BIT-GRAFANA-2026-9703 Viewer role can create, modify and delete Loki alerting rules

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role on an affected Grafana instance could send POST, PUT and DELETE requests through the proxy to the Loki rules API /loki/api/v1/rules, allowing...

EUVD-2026-108070

Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7...

CVE-2026-112312 WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7...

CVE-2026-112312 WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ACF Extended: from n/a through 0.9.2.7...

CVE-2026-112312

The ACF Extended WordPress plugin (versions

WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.2...

EUVD-2026-108057

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

CVE-2026-110893 WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

CVE-2026-110893

The WordPress SureDash plugin (versions up to and including 1.12.2 ) is susceptible to a Broken Access Control vulnerability (CWE-862). The root cause is a Missing Authorization issue where incorrectly configured security levels allow for the exploitation of access controls. This vulnerability im...

CVE-2026-110893 WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.2...

CVE-2026-110894 WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

CVE-2026-110894

The WordPress SureDash plugin (versions

EUVD-2026-108056

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

CVE-2026-110894 WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2...

WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by yzx001 in WordPress Plugin SureDash versions = 1.12.2...

EUVD-2026-108055

Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.0-beta.1...

CVE-2026-114180

Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through 4.3.2...

CVE-2026-114182

Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0...