PT-2026-104364

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoi...

PT-2026-104431

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.24.0 Description An information leak exists in the Pro add-on when at least one portal is configured. An unauthenticated user can retrieve the full internal record of a configured client portal by providing the...

PT-2026-104417

Name of the Vulnerable Software and Affected Versions Loom for AWS versions prior to 1.6.1 Description A missing authentication for a critical function in the authentication dependency allows remote actors to obtain super-admin authority over the agent control plane. This occurs in deployments...

CVE-2026-104410: Missing Authorization

SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document embedding a database view to obtain...

CVE-2026-103877: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server or pre-TLS MITM can answer a client's loadSchema subschema search with a schema object that contains a serialized Java class, allowing some potential RCE. This issue affects Apache...

CVE-2026-102731: Memory Allocation with Excessive Size Value

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

CVE-2026-51901

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoi...

PT-2026-104186

Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API versions 2.1.0 through 2.1.8 Description Sensitive information may be transmitted in cleartext. A StartTLS extended operation initiated after a Search request is sent can result in data being received in plain text...

CVE-2026-104416: Observable Discrepancy

Ghost from 4.39.0 before 6.64.0 contains an information disclosure vulnerability in the Admin API that allows staff users to view secret tokens of pending staff invites. Staff users with invite viewing permission can accept pending invites for higher-privileged roles to escalate their privileges...

PT-2026-104185

Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API versions 2.1.0 through 2.1.8 Description An issue exists involving the deserialization of untrusted data. A compromised LDAP server or a man-in-the-middle attacker can respond to a client's loadSchema subschema search...

PT-2026-104167

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

CVE-2026-97363: Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access...

Hardcoded JSON Web Tokens (JWT) in Brocade ASCG before 3.5.0 (CVE-2026-87424)

A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key...

CVE-2026-82042: Missing Authentication for Critical Function

UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access by presenting a valid Utm-Internal-Key header matching the INTERNALKEY environment variable value, which the InternalApiKeyFilter accepts for any endpoint...

Gitea API Endpoint Protected Information Exposure

The vulnerability of the endpoint /api/v1/teams/teamid of the Gitea Git repository management system is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea API Disclosure Sensitive Information

The vulnerability of endpoints /api/v1/user/orgs and /api/v1/users/username/orgs/org/permissions in the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

Gitea UpdatePullRequest Function Use-After-Free

The vulnerability of the UpdatePullRequest function in the routers/api/v1/repo/pull.go file of the Git repository management system Gitea is related to insufficient resource control during its existence. Exploiting this vulnerability could allow a malicious actor to compromise the integrity and...

Gitea Data Compromise

The vulnerabilities in the files routers/api/v1/api.go, routers/api/packages/api.go, services/context/api.go, and services/context/permission.go of the Git repository management system Gitea are related to access control deficiencies. Exploiting these vulnerabilities could allow a malicious actor...

Gitea DeleteIssueLabel Function Information Disclosure

The vulnerability of the DeleteIssueLabel function in the routers/api/v1/repo/issuelabel.go file of the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information that is protected...

ketello: Katello Content View History API Cross-Organization Authorization Bypass

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View...