PT-2026-123194

A vulnerability was found in 777genius agent-teams-ai up to 2.17.10. This issue affects the function doStart of the file src/main/services/infrastructure/HttpServer.ts of the component Local HTTP Service. The manipulation results in missing authentication. The attack is only possible with local...

JIZHICMS permission and access control issues vulnerability

Versions JIZHICMS 2.5.6 and earlier contain a security vulnerability. This vulnerability stems from improper handling of the ‘orderno’ parameter within the Pay function of the file app/home/c/OrderController.php in the Front-end Order Handler component. It may lead to unauthorized access, and...

vLLM configuration error vulnerability

Versions of vLLM prior to 0.32.0 contain a configuration error vulnerability. This vulnerability arises because OpenAI-compatible servers by default set allowedorigins for Starlette CORSMiddleware to a wildcard value. As a result, malicious web pages can exploit this flaw, allowing victims’...

Webasyst Framework cross-site request forgery vulnerability

Webasyst Framework versions 4.4.0 and earlier contain a cross-site request forgery vulnerability. This flaw arises because the Photos application fails to enable CSRF checks within the framework; it is thus susceptible to such attacks. Attackers can trick logged-in Photos users into visiting...

PT-2026-123362

boneIO Black does not limit authentication attempts on its web interface POST /api/login or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized acce...

Daniel Gatis Rembg path traversal vulnerability

Versions of Daniel Gatis Rembg prior to 2.0.82 contain a path traversal vulnerability. This vulnerability arises because the publicly accessible /api/remove endpoint passes an attacker-controlled extras.sammodel parameter to both the SAM filename and the GitHub download URL without validating its...

WordPress LearnPress authorization issue vulnerability

WordPress LearnPress versions 4.4.11 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of authorization checks, which may allow attackers to exploit improperly configured access control levels...

WordPress Discussion Board authorization issue vulnerability

WordPress Discussion Board versions 2.6.0 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may lead to exploitation of improperly configured access control levels...

Apple MacOS: CVE-2026-112647: OS X update for iCloud

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data...

ROS-20261026-73-0173

The vulnerability in openssh is related to errors in processing the relative path to the directory. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2026-123361

boneIO black debian images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write acces...

RHEL 9 : webkit2gtk3 (RHSA-2026:89821)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:89821 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: chromium-browser: skia:...

PT-2026-123469

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrowwidth - 1 without rejecting that geometry. An...

PT-2026-125305

This issue was addressed with improved input validation. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2. An app may be able to access sensitive user data...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 27.2, Apple iPadOS versions prior to 27.2, and Apple macOS Golden Gate versions prior to 27.2. This vulnerability stems from improper input validation and may allow applications to access sensitive user data...

PT-2026-123253

Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through 2.8.2...

PT-2026-123164

Electronic delivery item Inspection Support System provided by Japan's Ministry of Land, Infrastructure, Transport and Tourism contains an improper file access permission vulnerability. Files in the installation folder of the application may be tampered with, resulting in arbitrary code execution...

PT-2026-123200

Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through 1.0.10...

PT-2026-123284

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Innotim Software, Telecommunications, and Consulting Co. Ltd. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.120 before 6.4.122...

PT-2026-123262

Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1.10.7...