PT-2026-104062

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An API key is hardcoded and retrievable from the application package. Because Android applications can be reverse engineered, embedding sensitive API credential...

PT-2026-104111

The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's access mode was configured to hide...

Gitea DeleteIssueLabel Function Information Disclosure

The vulnerability of the DeleteIssueLabel function in the routers/api/v1/repo/issuelabel.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information that is protected...

Gitea Action ListWorkflowRuns Disclosure Sensitive Information

The vulnerabilities of the Action.ListWorkflowRuns and Action.ListWorkflowJobs methods in the routers/api/v1/org/action.go file of the Git repository management system Gitea are related to insufficient resource control during its existence. Exploiting these vulnerabilities could allow a malicious...

EUVD-2026-91703

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoi...

Gitea IsPublicMember Function Disclosure

The vulnerability of the IsPublicMember function in the routers/api/v1/org/member.go file of the Git repository management system Gitea is related to the use of a name with an incorrect reference. Exploiting this vulnerability could allow a remote attacker to expose protected information...

Gitea API Disclosure Protected Information

The vulnerability of the /api/v1/user/starred and /api/v1/user/subscriptions endpoints of the Git repository management system Gitea is related to insufficient protection of sensitive data. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

Gitea Data Compromise

The vulnerabilities in the files routers/api/v1/api.go, routers/api/packages/api.go, services/context/api.go, and services/context/permission.go of the Git repository management system Gitea are related to access control deficiencies. Exploiting these vulnerabilities could allow a malicious actor...

Gitea UpdatePullRequest Function Use-After-Free

The vulnerability of the UpdatePullRequest function in the routers/api/v1/repo/pull.go file of the Git repository management system Gitea is related to insufficient resource control during its existence. Exploiting this vulnerability could allow a malicious actor to compromise the integrity and...

PT-2026-104425

Name of the Vulnerable Software and Affected Versions Phproject versions prior to 1.8.7 Description An issue exists in the REST API where object-level authorization is missing. Authenticated users with a valid API key can bypass the security.restrict access confidentiality control because the...

PT-2026-105480

Same CWE-862 family, found via an automated bulk sweep of every /api/block/ handler in kernel/api/block.go for the presence of any access-check reference IsReadOnlyRoleContext, checkBlockPublishAccess, GetPublishAccess anywhere in the function body. 17 of 28 candidate endpoints have none...

CVE-2026-97363: Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access...

CVE-2026-105046: Direct Request

Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints...

CVE-2026-82044: Server-Side Request Forgery (SSRF)

UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request arbitrary internal resources by supplying an unvalidated url parameter to the PdfService.downloadPdf method exposed via GET /api/generate-pdf-report. Attacke...

CVE-2026-82043: Observable Response Discrepancy

UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can submit arbitrary email addresses and...

CVE-2026-82042: Missing Authentication for Critical Function

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNALKEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint...

CVE-2026-103956: Missing Authentication for Critical Function

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

CVE-2026-104991: Missing Authorization

Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints singleget, singlecomments, singlecommentspost that allows authenticated API key holders to bypass the security.restrictaccess confidentiality control by never invoking the allowAcces...

CVE-2026-104416: Observable Discrepancy

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges...

CVE-2026-104410: Missing Authorization

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain...