CVE-2026-15658

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record...

Insufficiently Protected Credentials

Overview flyto-core is an A workflow engine with 412 built-in modules. Trace every step. Replay from any point. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the baseurl parameter in the llm.chat, ai.model, llm.agent, and vector.connector processes. ...

Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

Summary llm.chat reads the operator's provider key from the environment OPENAIAPIKEY, ANTHROPICAPIKEY, ... and sends it in the Authorization: Bearer header to baseurl, a parameter the caller controls. baseurl is only checked against the SSRF guard, and the guard allows any public host, so pointin...

CVE-2026-54368

CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx and SearchExUnder that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized...

MCP Server Security: The Blind Spot in Your AI Stack

Short version: an MCP server is the tooling layer that lets an AI agent act on external systems. Hosted remotely, it is an API endpoint like any other — and it needs bot and WAF controls in front of it, API security on its own endpoints, and AI guardrails that inspect what the tools send back, no...

CVE-2026-54367

CentreStack prior to version 17.2 suffers an authentication bypass allowing unauthenticated attackers to read, modify, or delete arbitrary account settings by targeting exposed API endpoints with no authorization checks. Attackers can craft valid EntAcctId values by using a static shared encrypti...

CVE-2026-54367

CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary account settings by exploiting exposed API endpoints that lack authorization checks. Attackers can generate valid encrypted EntAcctId values using the...

CVE-2026-54365 CentreStack < 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dll

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious...

nanoid: nanoid: Predictable ID generation due to integer overflow

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the nanoidsize function. This issue causes the internal random number generator to become predictable, leading to t...

CLEANSTART-2026-IF92269 Security fixes in management-api-for-apache-cassandra-5.0 0.1.113-r1

Package management-api-for-apache-cassandra-5.0 version 0.1.113-r1 fixes 2 vulnerabilities: ghsa-84h7-rjj3-6jx4, ghsa-qqpg-mvqg-649v...

CLEANSTART-2026-LO26114 Security fixes in management-api-for-apache-cassandra-5.0 0.1.112-r0

Package management-api-for-apache-cassandra-5.0 version 0.1.112-r0 fixes 1 vulnerabilities: ghsa-84h7-rjj3-6jx4...

CLEANSTART-2026-XV94237 Security fixes in kubernetes-dashboard-api 1.14.0-r1

Package kubernetes-dashboard-api version 1.14.0-r1 fixes 27 vulnerabilities: ghsa-pc3f-x583-g7j2, CVE-2026-35469, CVE-2026-39820, CVE-2026-25679, CVE-2026-27143...

CLEANSTART-2026-NP47613 Security fixes in management-api-for-apache-cassandra-5.0 0.1.108-r0

Package management-api-for-apache-cassandra-5.0 version 0.1.108-r0 fixes 8 vulnerabilities: ghsa-4g8c-wm8x-jfhw, ghsa-jq43-27x9-3v86, ghsa-25qh-j22f-pwp8, ghsa-389x-839f-4rhx, ghsa-3p8m-j85q-pgmj...

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

CVE-2026-14602

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remot...

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

WordPress Search Atlas SEO plugin < 2.6.12 - Subscriber+ Google Indexing API Access vulnerability

Subscriber+ Google Indexing API Access vulnerability discovered by LevinityCyber in WordPress Plugin Search Atlas SEO versions 2.6.12...

CVE-2026-15252 Search Atlas SEO < 2.6.12 - Subscriber+ Google Indexing API Access

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and...

CVE-2026-15252

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and...

CVE-2026-15252

The Search Atlas SEO WordPress plugin, in versions prior to 2.6.12 , contains a vulnerability where one of its AJAX handlers fails to perform proper capability or nonce checks . This flaw allows any authenticated user, such as one with Subscriber privileges, to interact with the site's Google Ind...