PT-2026-104810

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used...

CVE-2026-105697: Improper Neutralization of Special Elements used in an OS Command

Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to...

CVE-2026-71298: Improper Neutralization of Special Elements used in an SQL Command

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

PT-2026-106190

A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the orderBy query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database...

PT-2026-106019

Name of the Vulnerable Software and Affected Versions Plane versions prior to 1.4.0 Description An authenticated user can retrieve API-token records via the 'GET /api/users/api-tokens/' endpoint. Additionally, the 'PATCH /api/users/api-tokens/token id/' endpoint allows a user to modify the allowe...

The vulnerability of the client API library for the IMAP protocol, written in Ruby, arises from incorrect filtering of input data. This allows attackers to trigger a service failure.

The vulnerability of the client API library for the IMAP protocol, written in Ruby, is related to incorrect filtering of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerability of the client API library for the IMAP protocol, written in Ruby, arises from the lack of data cleansing measures at the management level. This allows attackers to execute arbitrary commands.

The vulnerability of the client API library for the IMAP protocol, written in Ruby, is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

The vulnerability of the client API library for the IMAP protocol, written in Ruby, arises from the lack of data cleansing measures at the management level. This allows attackers to execute arbitrary commands.

The vulnerability of the client API library for the IMAP protocol, written in Ruby, is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

Vulnerability of endpoints/api/restore and/api/users/admin/init of the Kubernetes management platform, allowing attackers to escalate their privileges

The vulnerability of the endpoints /api/restore and /api/users/admin/init of the Kubernetes management platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain increased privileges remotely...

CVE-2026-105222

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2026-105222 alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2026-105222 alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2026-105222 alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer

The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets sslverifypeer to FALSE, which is passed to CURLOPTSSLVERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests...

CVE-2026-105221 Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification

The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because httpconnection in lib/gist.rb sets VERIFYNONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens...

CVE-2026-78906-ChatGPT-Prompt-Injection

CVE-2026-78906 — PromptGhost API ChatGPT — Injeção de Prompt & Exfiltração de Memória Campo| Valor ---|--- Gravidade| 8.7 Alta Vetor| Rede Versões Afetadas| API v1.0 – v1.3 Descoberto Por| 𝕍𝕠𝕤𝕤🥷 Descrição Uma vulnerabilidade crítica na API ChatGPT da OpenAI permite que um atacante injete prompts...

Exploit for Improper Authentication in Fortinet Fortiproxy

CVE-2022-40684 — FortiOS / FortiProxy / FortiSwitchManager Aut...

Security Bulletin: Vulnerabilities reported in cxf-rt-frontend-jaxrs-4.2.2.jar are addressed in APIM 11.1

Summary Vulnerabilities reported in cxf-rt-frontend-jaxrs-4.2.2.jar are addressed in APIM 11.1 Vulnerability Details CVEID:CVE-2026-57819 DESCRIPTION: Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. Howeve...

Security Bulletin: micrometer-core related vulnerabilities ireported n APIM 11.1

Summary micrometer-core related vulnerabilities ireported n APIM 11.1, are addressed by upgrade Vulnerability Details CVEID:CVE-2026-40984 DESCRIPTION: In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition. Affected...

CVE-2026-105205

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish-mode readers to learn backlink block IDs and reference counts from password-protected and publish-disabled documents by querying a published document. Attackers can send POST requests to /api/block/getDocInfo...

CVE-2026-105206

ZITADEL 3.0.0 through 3.4.15 and 4.x before 4.17.3 contains an incorrect authorization flaw in the User Service API, which verifies user.read against the caller's organization rather than the organization owning the target user. An authenticated member holding org-scoped user.read can query GET...