PT-2026-32584

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting XSS vulnerability that allows authenticated users to inject arbitrary HTML and JavaScript into the Application prologue Opening Remarks field by wrapping malicious payloads in tags...

PT-2026-32617

Name of the Vulnerable Software and Affected Versions MCPHub versions prior to 0.11.0 Description An authentication bypass exists because some endpoints are not protected by authentication middleware. This allows an unauthenticated attacker to perform actions on behalf of other users using their...

CVE-2026-39425: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

MaxKB is an open-source AI assistant for enterprise. Versions 2.7.1 and below contain a Stored Cross-Site Scripting XSS vulnerability that allows authenticated users to inject arbitrary HTML and JavaScript into the Application prologue Opening Remarks field by wrapping malicious payloads in tags...

CVE-2026-40313: Inclusion of Functionality from Untrusted Control Sphere

PraisonAI is a multi-agent teams system. In versions 4.5.139 and below, the GitHub Actions workflows are vulnerable to ArtiPACKED attack, a known credential leakage vector caused by using actions/checkout without setting persist-credentials: false. By default, actions/checkout writes the...

PraisonAI security vulnerabilities

PraisonAI is a low-code multi-agent collaboration framework developed by Mervin Praison. Versions of PraisonAI 4.5.139 and earlier contained security vulnerabilities. These vulnerabilities stemmed from known credential exposure risks in GitHub Actions workflows, which could allow attackers to...

PT-2026-32895

Name of the Vulnerable Software and Affected Versions Radware Alteon vADC load-balancer version 34.5.4.0 Description A Reflected Cross-Site Scripting XSS issue allows an attacker to inject malicious scripts into the website. This can lead to unauthorized actions, data theft, or other malicious...

EUVD-2026-22047

Pachno 1.0.6 contains a cross-site request forgery vulnerability that allows attackers to perform arbitrary actions in authenticated user context by exploiting missing CSRF protections on state-changing endpoints. Attackers can craft malicious requests targeting login, registration, file upload,...

CVE-2026-4401

The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the actionshandler and bulkactionshandler methods in class-dlm-downloads-path.php in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it...

CVE-2026-4124

The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The wpajaxziggeoajax handler only verifies a nonce checkajaxreferer but performs no capability checks via currentusercan. Furthermore, the nonce 'ziggeoajaxnonce' is exposed to all...

CVE-2026-40041

Pachno 1.0.6 contains a cross-site request forgery vulnerability that allows attackers to perform arbitrary actions in authenticated user context by exploiting missing CSRF protections on state-changing endpoints. Attackers can craft malicious requests targeting login, registration, file upload,...

Exploit for CVE-2025-54416

CVE-2025-54416: tj-actions/branch-names Command Injection PoC...

OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident

OpenAI revealed a GitHub Actions workflow used to sign its macOS apps led to the download of the malicious Axios library on March 31, but noted that no user data or internal system was compromised. "Out of an abundance of caution, we are taking steps to protect the process that certifies our macO...

📄 Pachno 1.0.6 Cross Site Request Forgery

Pachno version 1.0.6 suffers from a cross site request forgery vulnerability. Pachno 1.0.6 Cross-Site Request Forgery Vendor: Daniel André Eikeland Product web page: https://github.com/pachno/pachno Affected version: 1.0.6 Summary: Pachno is an open-source collaboration platform formerly known as...

PT-2026-32268

Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions...

nextjs-sa-dos-poc-20260413

Next.js Server Actions DoS — PoC Vulnerability: Unhandled...

Exploit for Server-Side Request Forgery in Vercel Next.Js

CVE-2024-34351 Demo Minimal Next.js 14.0.0 application for de...

Exploit for Deserialization of Untrusted Data in Facebook React

R2SAE - React2Shell Auto-Exploit A Firefox extension...

Exploit for CVE-2026-39866

CVE-2026-39866 — Command Injection via unquoted workflow dispa...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: karpenter, smokescreen, hubble, actions-runner-controller, omnibump, external-secrets-operator, dkron, flux-helm-controller, malcontent, polaris, mariadb-operator, github-mcp-server, volume-modifier-for-k8s, flux-image-automation-controller,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: git-sync, http-echo, actions-runner-controller, omnibump, helm-set-status, chisel, flux-helm-controller, kubernetes-csi-node-driver-registrar, redpanda, etcd, step-kms-plugin, redis-operator, contour, falcoctl, rqlite, dive, envoy-ratelimit, sftpgo-plugin-eventstore,...