CVE-2026-115718 Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...

CVE-2026-115718

Frappe Builder versions 1.33.0 before 1.36.0 are susceptible to a missing authorization vulnerability within the improve_prompt endpoint. This flaw allows any authenticated non-Guest session to bypass permission checks and invoke LLM completions. By calling the improve_prompt API, an attacker can...

EUVD-2026-109780

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...

CVE-2026-115718 Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

PT-2026-123444

A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been mad...

PT-2026-123287

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improve prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improve prompt API to leverage the site owner...

PT-2026-123297

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which cou...

Malicious Package

Overview youtube-search-without-api-key is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

MAL-2026-18270 Malicious code in youtube-search-without-api-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64255a9b30bfd083ac86612f2d7307de45dc83a57c42caf459cfb8df21dc2bf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in youtube-search-without-api-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64255a9b30bfd083ac86612f2d7307de45dc83a57c42caf459cfb8df21dc2bf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in youtube-search-without-api-key

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

kamerka

NOT SUPPORTED OR DEVELOPED ANYMORE PLEASE USE GUI VERSION https://github.com/woj-ciech/Kamerka-GUI ꓘamerka 2.0 aka FIST Flickr, Instagram, Shodan, Twitter Build interactive map of cameras, printers, tweets and photos. The script creates a map of cameras, printers, tweets and photos based on your...

WordPress Infility Global plugin < 2.16.25 - Unauthenticated Google Translate API Key Update vulnerability

Unauthenticated Google Translate API Key Update vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Infility Global versions 2.16.25...

follow-redirects: follow-redirects: Information disclosure via cross-domain redirects

A flaw was found in follow-redirects. When an HTTP request follows a cross-domain redirect a redirection to a different domain, custom authentication headers, such as X-API-Key or X-Auth-Token, are not properly stripped. This allows these sensitive headers to be forwarded verbatim to the redirect...

CVE-2026-114662 Obot before 0.26.0 API Key Theft via CLI Login Token Request

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the...

CVE-2026-114662 Obot before 0.26.0 API Key Theft via CLI Login Token Request

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POST /api/token-request, send the login link to a signed-in user, and fetch the...

CVE-2026-114662

Obot versions before 0.26.0 are vulnerable to an authentication bypass in the CLI login flow. Unauthenticated attackers can steal non-expiring API keys by creating a token request via POST /api/token-request and sending the login link to a signed-in user. By choosing specific token request IDs, t...

Exposure Of Sensitive Information

A2A Java SDK is vulnerable to Exposure of Sensitive Information. The vulnerability is due to failure to validate the API key's declared location and prevent credential-bearing custom headers from being forwarded across cross-origin redirects, which allows a malicious or compromised remote agent t...

CVE-2026-111765

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...