CVE-2026-112297

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...

grafana: Grafana: Unauthorized cross-organization user management via the SCIM API

A flaw was found in Grafana. An authenticated service account with user-management permissions in one organization can access users in other organizations on the same instance due to missing access controls in the System for Cross-domain Identity Management SCIM API. This allows an authorized...

CVE-2026-112297

A server-side request forgery (SSRF) vulnerability exists in ptbsare anx-calibre-manager versions up to 1.13.12 . The flaw is located within the LLM Configuration Handler component, specifically in the LLMClient.chat function of the file blueprints/api/llm.py. An attacker can remotely initiate th...

CVE-2026-112297 ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...

CVE-2026-112297 ptbsare anx-calibre-manager LLM Configuration llm.py LLMClient.chat server-side request forgery

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...

EUVD-2026-104594

A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument baseurl causes server-side request forgery. The attack can be...

CVE-2026-73804

A flaw was found in Gitea. An authenticated attacker with a restricted user-level Application Programming Interface API token can achieve privilege escalation by registering an arbitrary Secure Shell SSH public key to the account. Subsequent API requests signed with the corresponding private key...

CVE-2026-109434

Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browser's trusted address bar by entering fullscreen mode via the Fullscreen API without displaying a persistent notification or trusted-origin indicator. Attacker...

CVE-2026-109437

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

CVE-2026-112779

The Grav API plugin (grav-plugin-api) versions 1.0.40 before 1.0.42 contains a vulnerability where the unauthenticated GET /api/v1/translations/{lang} endpoint caches a full translation dictionary for every well-formed language code. Unauthenticated attackers can exploit this via small requests t...

CVE-2026-112779 Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass

Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...

EUVD-2026-104585

Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...

CVE-2026-112779

Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...

CVE-2026-112779 Grav API Plugin before 1.0.42 Cache Exhaustion and Page Permission Bypass

Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...

CVE-2026-109437

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

CVE-2026-109437 Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

CVE-2026-109437 Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

CVE-2026-109437 Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

EUVD-2026-104570

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST...

CVE-2026-109437

The Cognition software (versions prior to 0.13.0 ) is vulnerable to unauthenticated remote code execution (RCE) . The root cause is the lack of authentication on the REST/SSE API combined with the agent sandbox backend defaulting to local execution . An attacker can exploit this by creating a ses...