CVE-2026-100603

The ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow. Four distinct ordinary authenticated accounts can coordinate to report a visible skill, triggering its automatic hiding (moderationStatus: hidden) from the catalog without a moderator's decisio...

CVE-2026-76820: Server-Side Request Forgery (SSRF)

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260701.0, the synchronizerFetch GraphQL query called fetchRemoteStreams after checking only that a remote stream URL used HTTP or HTTPS. The backend did not apply the ingestion deny lis...

CVE-2026-88875 AVideo Incomplete API Sanitization Information Disclosure

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::getapivideo calls removeSensitiveUserFields only when the...

CVE-2026-88875: Exposure of Private Personal Information to an Unauthorized Actor

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::getapivideo calls removeSensitiveUserFields only when the...

CVE-2026-80348: Missing Authorization

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds and dispatches a deployment task to every server matching...

CVE-2026-72719: Improperly Controlled Modification of Dynamically-Determined Object Attributes

Chatwoot is a customer engagement suite. Prior to 4.9.0, Chatwoot allowed authenticated account administrators to transfer Portals, Automation Rules, Macros, and Twilio Channels to other accounts through the writable accountid parameter. This could break tenant isolation and cause cross-account...

Authorization Bypass Through User-Controlled Key

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the GraphQL node's Authentication parameter, which accepts expression values and, when several credentials of different types are attached in...

JFrog Artifactory 7.146.x < 7.146.34 / 7.161.x < 7.161.15 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is affected by multiple vulnerabilities: - An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful...

Server-side Request Forgery (SSRF)

Overview @budibase/backend-core is a Budibase backend core libraries used in server and worker Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the REST datasource integration due to improper handling of DNS rebinding protections. An attacker can access...

PT-2026-57416

Name of the Vulnerable Software and Affected Versions The Essential Addons for Elementor versions prior to 6.6.11 Description Insufficient server-side validation of a Login/Register widget setting allows authenticated attackers with Contributor-level access or higher to perform Email Header...

Information Exposure

Overview pterodactyl/panel is a game management panel. Affected versions of this package are vulnerable to Information Exposure via the email update process. An attacker can determine whether specific email addresses are registered by sending repeated requests and observing the system's responses...

CVE-2026-29202

Insufficient input validation of the plugin parameter of the createuser plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user...

PT-2025-46314

Name of the Vulnerable Software and Affected Versions VAPIX API affected versions not specified Description The VAPIX API’s port.cgi component lacks adequate input validation. This can lead to process crashes and negatively affect usability. Exploitation requires authentication with a viewer,...

CVE-2025-26392

SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerability requires authentication from a low-privilege account...

CVE-2025-26392

SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerability requires authentication from a low-privilege account...

CVE-2025-26392

SolarWinds Observability Self-Hosted is affected by CVE-2025-26392: an SQL injection vulnerability that can disclose sensitive data when authenticated from a low-privilege account. The issue affects the product as described in multiple sources (NVD, Red Hat/CIRCL/CVE lists and related advisories)...

EUVD-2020-18676

Malware in sbrugna...

EUVD-2025-31761

Malicious code in bioql PyPI...

CVE-2025-3793 Buddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update

The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bpforcepasswordajax' function in all versions up to, and including, 0.1. This makes i...

CVE-2025-3793 Buddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update

The Buddypress Force Password Change plugin for WordPress is vulnerable to authenticated account takeover due to the plugin not properly validating a user's identity prior to updating their password through the 'bpforcepasswordajax' function in all versions up to, and including, 0.1. This makes i...