CVE-2026-55089

Etherpad (real-time collaborative editor) versions 2.1.0 through 3.1.0 contain a critical authorization bypass in the OAuth authorization_code path. The APIHandler.ts file checks only for the presence of the admin JWT claim rather than its boolean value, while OAuth2Provider.ts issues admin: fals...

CVE-2026-62670

CVE-2026-62670 is a fail-open authorization flaw in the Grav Flex Objects Plugin (by Trilby Media) prior to version 1.4.3 . The requireFlexPermission() method in classes/Api/FlexApiController.php (Admin Next API) returns without denying access when a directory blueprint omits config.admin.permiss...

CVE-2026-75951

J-BusinessDirectory extension (versions before 6.2.3) contains an Insecure Direct Object Reference flaw across multiple frontend/API actions, allowing unauthenticated remote attackers to access or modify other users' data; CVSS 6.9 (Medium). Remediation is to upgrade to version 6.2.3 or later. No...

CVE-2026-76211

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATIONEDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind...

EUVD-2026-61484

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

CVE-2026-12564

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

CVE-2026-12564 Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credential ssrf

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...

CVE-2026-75836 Grav API Plugin before 1.0.14 Missing Authorization

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction. While the GET /menubar/items listing endpoint correctly filters menubar items via userPassesAuthorize, the POST...

CVE-2026-74881

openssl_encrypt (PyPI) versions before 1.4.0 ship both standalone servers (key-server and telemetry-server ) with the most permissive CORS configuration: allow_origins=["*"] combined with allow_credentials=True, allow_methods=["*"], and allow_headers=["*"]. The same wildcard default appears in do...

CVE-2026-74800

SiYuan before v3.7.4 serves uploaded HTML files without Content-Disposition or X-Content-Type-Options headers, enabling authenticated attackers to inject stored XSS that runs with full kernel API access when the workspace owner clicks the asset link; upgrade to v3.7.4 or later. No active exploita...

EUVD-2026-60083

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace own...

PT-2026-76599

SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full kernel API access when the workspace own...

EUVD-2026-58645

The Flex Objects plugin through 1.4.6, tested with Grav 2.0.11 contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the...

CVE-2026-73666

OpenChoreo is a developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.1, the OpenChoreo Backstage backend hardcoded backend.auth.dangerouslyDisableDefaultAuthPolicy and auth.providers.guest.dangerouslyAllowOutsideDevelopment to true, exposing /api/ without authentication and allowing...

CVE-2026-57897

Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs...

PT-2026-70357

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX CODE ONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'child...

CVE-2026-69116 FlyEnv < 4.18.0 Cross-Site Scripting via v-html

FlyEnv before 4.18.0 fails to sanitize HTML from markdown rendering and AI chat content passed to Vue v-html directives. Attackers can inject malicious scripts through markdown sources or chat messages that execute in the Electron renderer process with access to Node.js APIs and the filesystem...

CVE-2026-17018

The CubeWP Framework WordPress plugin (versions through 1.1.30 ) contains a broken access control vulnerability on one of its REST API endpoints . The root cause is a lack of per-object read authorization checks and insufficient restrictions on requested metadata keys . This flaw allows users wit...

CVE-2026-14943 Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API

The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read...

Cleartext Storage of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information through the clusterregistrationtoken API/store paths, pkg/capr/planner/agent.go, pkg/provisioningv2/prebootstrap/resolve.go, and pkg/controllers/capr/managesystemagent/managesystemagent.go. An...