CVE-2026-51899

In SuperAGI v0.0.14 and prior, controller endpoints /api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/editschedule, /api/agents/stopschedule allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different...

CVE-2026-97637: Improper Authentication

The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and including, 3.1.2. The vulnerability exists because the required PI-Media/json-api parent plugin caches controller dispatch results in transients keyed sole...

PT-2026-104152

Name of the Vulnerable Software and Affected Versions JSON API Auth plugin for WordPress versions prior to 3.1.3 Description An authentication bypass exists due to cached session cookie disclosure. The PI-Media/json-api parent plugin caches controller dispatch results in transients based only on...

CVE-2026-104416: Observable Discrepancy

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges...

PT-2026-104446

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16 Description Authenticated attackers can perform a server-side request forgery SSRF, a flaw where the server is tricked into making requests to an unintended location. By providing an unvalidated url parameter...

PT-2026-104221

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain...

PT-2026-104227

Name of the Vulnerable Software and Affected Versions Ghost versions 4.39.0 through 6.63.x Description An information disclosure issue exists in the Admin API that allows staff users to view secret tokens associated with pending staff invites. Staff users who possess invite viewing permissions ca...

CVE-2026-104415: Observable Discrepancy

Ghost from 0.7.2 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff-level users to determine the relative ordering of other staff users' password hashes. Authenticated staff users can query the Admin API to infer hash ordering, though this does not...

CVE-2026-104410: Missing Authorization

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain...

PT-2026-104445

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16 Description An account enumeration issue exists that allows unauthenticated attackers to identify registered email addresses. By sending requests to the 'POST /api/account/reset-password/init' endpoint,...

CVE-2026-82043: Observable Response Discrepancy

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

PT-2026-104061

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An API key is hardcoded and can be retrieved from the application package. Because Android applications are susceptible to reverse engineering, embedding sensiti...

CVE-2026-104461: Improper Neutralization of Input During Web Page Generation

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in the Bazar FileField, which validates only the upload's file extension and never calls HtmlPurifierService::cleanFile, so SVG files are stored verbatim and served inline as image/svg+xml. Authenticated users can submit...

CVE-2026-97219: Missing Authorization

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...

CVE-2026-103878: Insufficient Verification of Data Authenticity

Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search request has been sent can lead to receive data in plain text before the TLS Handshake has been completed. This issue affects Apache Directory LDAP API:...

PT-2026-104434

Name of the Vulnerable Software and Affected Versions UTMStack versions prior to 11.2.16 Description An issue exists in the searchQueryBuilder function of UtmAssetGroupService where authenticated attackers can inject arbitrary SQL. This occurs because the assetType and groupName variables are...

PT-2026-104115

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...

Unauthenticated Administrative REST API Access in Brocade ASCG before 3.5.0 (CVE-2026-85489)

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...

Grafana Labs 12.3.x < 12.4.12 / 13.0.x < 13.0.10 / 13.1.x < 13.1.7 / 13.2.x < 13.2.3 Information Disclosure (CVE-2026-13719)

The version of Grafana Labs installed on the remote host is 12.3.x through 12.4.x prior to 12.4.12, or 13.0.x prior to 13.0.10, or 13.1.x prior to 13.1.7, or 13.2.x prior to 13.2.3. It is, therefore, affected by an information disclosure vulnerability: - An authenticated user can list alert rules...

RabbitMQ 4.1.x < 4.1.11 / 4.2.x < 4.2.9 / 4.3.x < 4.3.3 Super Stream Binding Keys Denial of Service

The version of RabbitMQ installed on the remote host is 4.1.x prior to 4.1.11, or 4.2.x prior to 4.2.9, or 4.3.x prior to 4.3.3. It is, therefore, affected by a denial of service vulnerability: - The stream management HTTP API handler for super stream creation PUT...