CVE-2026-105798: Improper Neutralization of Input During Web Page Generation

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/groupdocuments/upload stores an attacker-controlled group document filename that groupworkspaces.html later interpolates into inline Share event...

CVE-2025-71384: Stack-based Buffer Overflow

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...

WP < 7.1.3 - Author+ Sticky Post via REST API

Description WordPress does not correctly verify user capabilities before allowing a post to be set as sticky via the REST API in some cases, which could allow users with Author-level access and above to feature their own posts on the site front page, an action intended to require higher privilege...

PT-2026-107209

Name of the Vulnerable Software and Affected Versions ClearPass Policy Manager affected versions not specified Description A SQL injection flaw exists in the API of ClearPass Policy Manager. This issue allows a remote authenticated attacker with administrative privileges to perform SQL injection...

PT-2026-106307

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

CVE-2026-105790: Server-Side Request Forgery (SSRF)

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinnedaddresses only to...

PT-2026-106781

Name of the Vulnerable Software and Affected Versions Payload versions 3.0.0 through 3.89.9 Payload versions 4.0.0-canary.1 through 4.0.0-canary.33 Description Users with ordinary read access to authentication documents in a collection where useAPIKey is enabled can obtain active API keys. This...

Security Advisory 0185

Security Advisory 0185 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-101158 CVSSv3.1 Base Score: 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H CVSSv4.0 Base Score: 9.3...

PT-2026-106768

Name of the Vulnerable Software and Affected Versions @payloadcms/plugin-mcp versions 3.61.0 through 3.87.0 Description An authenticated user can manage MCP API keys outside the intended account, which allows for privilege escalation through account takeover. Recommendations Update...

PT-2026-107294

The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachment id also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...

CVE-2026-105268: Authorization Bypass Through User-Controlled Key

The Gitea API routes for issue attachments /api/v1/repos/owner/repo/issues/index/assets/attachmentid also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user who opened an issue could rename or delete...

CVE-2026-105806: Missing Authorization

Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeover. This issue is fixed in version...

PT-2026-106460

Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API = 1.6.3 versions...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : OpenStack Aodh and Watcher vulnerability (USN-8870-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8870-1 advisory. Chen YuXiang discovered that OpenStack Aodh did not correctly enforce project scoping in its alarm list API and that the OpenStack Watcher...

Elasticsearch 9.0.x < 9.4.6 / 9.5.x < 9.5.2 DoS (ESA-2026-196)

The version of Elasticsearch installed on the remote host is 9.0.x prior to 9.4.6, or 9.5.x prior to 9.5.2. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-196 advisory. - Uncontrolled Recursion CWE-674 in Elasticsearch can lead to Denial of Service via a specially...

CVE-2026-97208: Incorrect Authorization

The Gitea API endpoint for creating push mirrors POST /api/v1/repos/owner/repo/pushmirrors checked only whether mirroring was enabled and not the mirror DISABLENEWPUSH setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where th...

PT-2026-106754

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so tha...

CVE-2026-105849: Insertion of Sensitive Information Into Sent Data

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise t...

PT-2026-106342

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...

CVE-2026-96594: Improper Neutralization of Input During Web Page Generation

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...