CVE-2026-111668 AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API

AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read...

CVE-2026-111668

The AIHelms application (through version 0.1.25 ) contains a missing authorization vulnerability in the apps/api/v1/efficiency.py component. This flaw allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Consequently, an attacker can access s...

CVE-2026-111668 AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API

AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read...

CVE-2026-109930

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded...

CVE-2026-109930

The MAIO WordPress plugin (versions before 7.3.22 ) contains a vulnerability where it fails to properly restrict access to its analytics data. The software treats a hardcoded credential shipped verbatim in its public source as a valid API key. This flaw allows unauthenticated attackers to retriev...

CVE-2026-109930 MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded...

EUVD-2026-102837

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded...

WordPress MAIO plugin < 7.3.22 - Unauthenticated Crawl Analytics Disclosure vulnerability

Unauthenticated Crawl Analytics Disclosure vulnerability discovered by Ryan Fabella in WordPress Plugin MAIO The new AI GEO / SEO tool versions 7.3.22...

CVE-2026-109930: Exposure of Sensitive Information to an Unauthorized Actor

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded...

PT-2026-115579

Name of the Vulnerable Software and Affected Versions MAIO WordPress plugin versions prior to 7.3.22 Description Insufficient access restrictions to analytics data allow unauthenticated attackers to retrieve the stored crawl-analytics log. This occurs because the plugin treats a credential value...

Multiple Vulnerabilities in Hitachi Command Suite, Hitachi Automation Director, Hitachi Configuration Manager, Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center

Overview Multiple vulnerabilities have been found in Hitachi Command Suite, Hitachi Automation Director, Hitachi Configuration Manager, Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center. The product name in Hitachi Command Suite is changed in Hitachi Ops Center series on some...

CVE-2026-101966

A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener...

EUVD-2026-101425

A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener...

CVE-2026-101966 Junos OS Evolved: A crafted analytics sensor resource causes telemetry dial-out daemon denial of service

A Use of Externally-Controlled Format String vulnerability in the jti-dialoutd of Juniper Networks Junos OS Evolved allows an authenticated network attacker to cause persistent telemetry dial-out denial of service via a crafted analytics sensor resource submitted through gNMI listener...

CVE-2026-103369

The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-103369 Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX

The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-103369 Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX

The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-100811

The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-103369

The Social Share Buttons & Analytics Plugin (GetSocial.io) for WordPress, in versions up to and including 4.5 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the response parameter via the gs_update_with_values AJ...

PT-2026-114063

Name of the Vulnerable Software and Affected Versions Swetrix Cloud versions prior to 5.1.0 Description An authorization flaw exists in the addProject function within the ProjectController. This issue allows authenticated users to hijack arbitrary projects by moving them into an organization they...