PT-2026-32617

Name of the Vulnerable Software and Affected Versions MCPHub versions prior to 0.11.0 Description An authentication bypass exists because some endpoints are not protected by authentication middleware. This allows an unauthenticated attacker to perform actions on behalf of other users using their...

EUVD-2026-22047

Pachno 1.0.6 contains a cross-site request forgery vulnerability that allows attackers to perform arbitrary actions in authenticated user context by exploiting missing CSRF protections on state-changing endpoints. Attackers can craft malicious requests targeting login, registration, file upload,...

CVE-2026-4401

The Download Monitor plugin for WordPress is vulnerable to Cross-Site Request Forgery in the actionshandler and bulkactionshandler methods in class-dlm-downloads-path.php in all versions up to, and including, 5.1.10. This is due to missing nonce verification on these functions. This makes it...

CVE-2026-4124

The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The wpajaxziggeoajax handler only verifies a nonce checkajaxreferer but performs no capability checks via currentusercan. Furthermore, the nonce 'ziggeoajaxnonce' is exposed to all...

CVE-2026-40041

Pachno 1.0.6 contains a cross-site request forgery vulnerability that allows attackers to perform arbitrary actions in authenticated user context by exploiting missing CSRF protections on state-changing endpoints. Attackers can craft malicious requests targeting login, registration, file upload,...

Exploit for CVE-2025-54416

CVE-2025-54416: tj-actions/branch-names Command Injection PoC...

OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident

OpenAI revealed a GitHub Actions workflow used to sign its macOS apps led to the download of the malicious Axios library on March 31, but noted that no user data or internal system was compromised. "Out of an abundance of caution, we are taking steps to protect the process that certifies our macO...

📄 Pachno 1.0.6 Cross Site Request Forgery

Pachno version 1.0.6 suffers from a cross site request forgery vulnerability. Pachno 1.0.6 Cross-Site Request Forgery Vendor: Daniel André Eikeland Product web page: https://github.com/pachno/pachno Affected version: 1.0.6 Summary: Pachno is an open-source collaboration platform formerly known as...

PT-2026-32268

Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions...

nextjs-sa-dos-poc-20260413

Next.js Server Actions DoS — PoC Vulnerability: Unhandled...

Exploit for Server-Side Request Forgery in Vercel Next.Js

CVE-2024-34351 Demo Minimal Next.js 14.0.0 application for de...

Exploit for Deserialization of Untrusted Data in Facebook React

R2SAE - React2Shell Auto-Exploit A Firefox extension...

Exploit for CVE-2026-39866

CVE-2026-39866 — Command Injection via unquoted workflow dispa...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: grafana-operator, kubewatch, external-secrets-operator, dbmate, polaris, clickhouse-operator, mariadb-operator, smokescreen, nodetaint, dkron, omnibump, actions-runner-controller, gh, pluto, local-path-provisioner, envoy-ratelimit, go, flux-helm-controller,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: kafkaexporter, kubewatch, kyverno-notation-aws, rancher-machine, verticadb-operator, k8ssandra-client, opentelemetry-operator, terraform, terraform-provider-azapi, aws-s3-controller, spegel, kyverno-policy-reporter-kyverno-plugin, cert-exporter, vault-secrets-webhook...

Ech0 Comment Panel Endpoints Missing RequireScopes Middleware — Scoped Access Token Bypass

Summary All 9 comment panel admin endpoints /api/panel/comments/ are missing RequireScopes middleware, while every other admin endpoint in the application enforces scope-based authorization on access tokens. An admin-issued access token scoped to minimal permissions e.g., echo:read only can perfo...

CVE-2026-35648

OpenClaw before 2026.3.22 contains a policy bypass vulnerability where queued node actions are not revalidated against current command policy when delivered. Attackers can exploit stale allowlists or declarations that survive policy tightening to execute unauthorized commands...

CVE-2026-35669

OpenClaw before 2026.3.25 contains a privilege escalation vulnerability in gateway-authenticated plugin HTTP routes that incorrectly mint operator.admin runtime scope regardless of caller-granted scopes. Attackers can exploit this scope boundary bypass to gain elevated privileges and perform...

CVE-2026-35652

OpenClaw before 2026.3.22 contains an authorization bypass vulnerability in interactive callback dispatch that allows non-allowlisted senders to execute action handlers. Attackers can bypass sender authorization checks by dispatching callbacks before normal security validation completes, enabling...

CVE-2026-35652

OpenClaw before 2026.3.22 contains an authorization bypass in the interactive callback dispatch that lets non-allowlisted senders execute action handlers. Attackers can bypass sender authorization checks by dispatching callbacks before normal security validation completes, enabling unauthorized a...