CVE-2026-103111: Out-of-bounds Write

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data...

CVE-2026-103111: Out-of-bounds Write

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data...

PT-2026-103073

Name of the Vulnerable Software and Affected Versions Grafana affected versions not specified Description An Editor can set file-provisioning metadata when creating a dashboard through the dashboard API because certain fields are stored without an authorization check. This allows the creation of...

PT-2026-103286

LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause generation, /abort request, /flush cache, and /init weights update group to disrupt inference operations and wedge...

PT-2026-103194

Name of the Vulnerable Software and Affected Versions SiteSkite versions prior to 2.2.0 Description An unauthenticated remote code execution issue exists due to a critical chain involving API-key autologin and the eval function within the MCP component. This allows an attacker to execute arbitrar...

PT-2026-103298

Name of the Vulnerable Software and Affected Versions JCTables version 1.21.1 Description An unauthenticated SQL injection exists in the front-end CRUD API controller. The component fails to perform Joomla token validation and authentication checks on any task. Table names, column names, and valu...

PT-2026-103045

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content...

PT-2026-103617

Name of the Vulnerable Software and Affected Versions DB-GPT version 0.8.0 Description The sandbox API silently falls back to LocalRuntime, which allows for the execution of arbitrary code on the host system. Recommendations At the moment, there is no information about a newer version that contai...

EUVD-2026-90419

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py...

PT-2026-103567

Name of the Vulnerable Software and Affected Versions Kiteworks Core affected versions not specified Description Kiteworks Core failed to apply gateway-level API security controls to all requests authenticated via the central authentication service. This allows an authenticated user to access RES...

PT-2026-103594

Name of the Vulnerable Software and Affected Versions Inspur Haiyue HCM Cloud affected versions not specified Description An arbitrary file read issue exists in the '/api/model report/file/download' endpoint. Unauthenticated remote attackers can read arbitrary files by providing unvalidated path...

CVE-2026-51866: Improper Control of Generation of Code

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through the real /api/v1/chat/react-agent flow...

VulnCheck KEV: CVE-2024-58387

Inspur Haiyue HCM Cloud contains an arbitrary file read vulnerability in the /api/modelreport/file/download endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying unvalidated path parameters index and ext. Attackers can craft requests such as...

CVE-2026-86789: Exposure of Sensitive Information to an Unauthorized Actor

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending...

CVE-2026-102134: Unprotected Alternate Channel

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform's central authentication service. An authenticated user could reach REST API functionality over a request path on which those controls, including enforcement of signed-out and...

PT-2026-103615

Name of the Vulnerable Software and Affected Versions DB-GPT versions 0.7.5 through 0.8.0 Description A code injection issue exists where a skill uploaded via the '/api/v1/skills/upload' endpoint can subsequently be executed through the '/api/v1/chat/react-agent' flow. Recommendations At the...

PT-2026-103027

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data id, username, email address and registration date of registered...

PT-2026-103121

Name of the Vulnerable Software and Affected Versions Claude Code versions 2.0.68 through 2.1.259 Description Claude Code prioritized a locally stored API key, such as one from a previous /login or configuration file, over a valid Claude Enterprise or Team sign-in when retrieving server-managed...

PT-2026-103032

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending...

CVE-2026-102999: Uncontrolled Resource Consumption

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/doccommon.py to reparse the full attachment list for each content lookup, producing repeated work and long runtimes when a...