CVE-2026-40474 wger has Broken Access Control in the Global Gym Configuration Update Endpoint

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permissionrequired = 'config.changegymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never enforced at runtime. Since GymConfig is an...

CVE-2026-40474 wger has Broken Access Control in the Global Gym Configuration Update Endpoint

wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permissionrequired = 'config.changegymconfig' but inherits WgerFormMixin instead of WgerPermissionMixin, so the permission is never enforced at runtime. Since GymConfig is an...

GHSA-W47F-J8RH-WX87 Flowise: Public chatflow endpoints return unsanitized flowData including plaintext API keys, passwords, and credential IDs

Summary The GET /api/v1/public-chatflows/:id endpoint returns the full chatflow object without sanitization for public chatflows. Docker validation revealed this is worse than initially assessed: the sanitizeFlowDataForPublicEndpoint function does NOT exist in the released v3.0.13 Docker image...

CVE-2026-35603

Claude Code is an agentic coding tool. In versions prior to 2.1.75 on Windows, Claude Code loaded the system-wide default configuration from C:\ProgramData\ClaudeCode\managed-settings.json without validating directory ownership or access permissions. Because the ProgramData directory is writable ...

org.pac4j:pac4j-cas (4.5.3), org.pac4j:pac4j-config (4.5.3) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (4.5.3)

org.pac4j:pac4j-core MAVEN version 4.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 4.5.3 - org.pac4j:pac4j-config 4.5.3 - org.pac4j:pac4j-couch 4.5.3 - org.pac4j:pac4j-gae 4.5.3 -...

org.pac4j:pac4j-cas (4.5.10), org.pac4j:pac4j-config (4.5.10) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (4.5.10)

org.pac4j:pac4j-core MAVEN version 4.5.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 4.5.10 - org.pac4j:pac4j-config 4.5.10 - org.pac4j:pac4j-couch 4.5.10 - org.pac4j:pac4j-gae 4.5.10...

org.pac4j:pac4j-cas (3.8.0), org.pac4j:pac4j-config (3.8.0) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (3.8.0)

org.pac4j:pac4j-core MAVEN version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 3.8.0 - org.pac4j:pac4j-config 3.8.0 - org.pac4j:pac4j-couch 3.8.0 - org.pac4j:pac4j-gae 3.8.0 -...

org.pac4j:pac4j-cas (3.6.0), org.pac4j:pac4j-config (3.6.0) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (3.6.0)

org.pac4j:pac4j-core MAVEN version 3.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 3.6.0 - org.pac4j:pac4j-config 3.6.0 - org.pac4j:pac4j-couch 3.6.0 - org.pac4j:pac4j-gae 3.6.0 -...

org.pac4j:pac4j-cas (1.9.3), org.pac4j:pac4j-config (1.9.3) +12 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.9.3)

org.pac4j:pac4j-core MAVEN version 1.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 1.9.3 - org.pac4j:pac4j-config 1.9.3 - org.pac4j:pac4j-gae 1.9.3 - org.pac4j:pac4j-http 1.9.3 -...

org.pac4j:pac4j-cas (1.9.8), org.pac4j:pac4j-config (1.9.8) +11 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.9.8)

org.pac4j:pac4j-core MAVEN version 1.9.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 1.9.8 - org.pac4j:pac4j-config 1.9.8 - org.pac4j:pac4j-gae 1.9.8 - org.pac4j:pac4j-http 1.9.8 -...

org.pac4j:pac4j-cas (1.8.3), org.pac4j:pac4j-config (1.8.3) +15 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.8.3)

org.pac4j:pac4j-core MAVEN version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:pac4j-cas 1.8.3 - org.pac4j:pac4j-config 1.8.3 - org.pac4j:pac4j-gae 1.8.3 - org.pac4j:pac4j-http 1.8.3 -...

org.pac4j:j2e-pac4j (1.3.0), org.pac4j:pac4j-cas (1.9.0) +14 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.9.0)

org.pac4j:pac4j-core MAVEN version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:j2e-pac4j 1.3.0 - org.pac4j:pac4j-cas 1.9.0 - org.pac4j:pac4j-config 1.9.0 - org.pac4j:pac4j-gae 1.9.0 -...

com.efluid.oss:efluid-datagate-app (>=1.0.0-beta-21, <=3.1.1), com.efluid.oss:efluid-datagate-app-cucumber (>=1.0.0-beta-21, <=3.1.1) +17 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (3.3.0)

org.pac4j:pac4j-core MAVEN version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - com.efluid.oss:efluid-datagate-app =1.0.0-beta-21, =1.0.0-beta-21, =3.1.1 - org.pac4j:j2e-pac4j 4.1.0 -...

com.yahoo.sherlock:sherlock (>=1.11, <=1.13), org.pac4j:pac4j-cas (3.2.0) +18 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (3.2.0)

org.pac4j:pac4j-core MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - com.yahoo.sherlock:sherlock =1.11, =1.13 - org.pac4j:pac4j-cas 3.2.0 - org.pac4j:pac4j-config 3.2.0 -...

org.marid:marid-ide-server (0.9.8.6), org.pac4j:pac4j-cas (3.8.1) +12 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (3.8.1)

org.pac4j:pac4j-core MAVEN version 3.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.marid:marid-ide-server 0.9.8.6 - org.pac4j:pac4j-cas 3.8.1 - org.pac4j:pac4j-config 3.8.1 - org.pac4j:pac4j-couch...

org.pac4j:dropwizard-pac4j (2.0.0-rc1), org.pac4j:j2e-pac4j (2.0.0-rc1) +15 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (2.0.0-rc1)

org.pac4j:pac4j-core MAVEN version 2.0.0-rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - org.pac4j:dropwizard-pac4j 2.0.0-rc1 - org.pac4j:j2e-pac4j 2.0.0-rc1 - org.pac4j:jax-rs-pac4j 2.0.0-rc1 -...

io.buji:buji-pac4j-core (>=1.4.2, <=1.4.3), io.buji:buji-pac4j-servlet (>=1.4.2, <=1.4.3) +18 more potentially affected by CVE-2026-40458 via org.pac4j:pac4j-core (1.8.7)

org.pac4j:pac4j-core MAVEN version 1.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.pac4j:pac4j-core and may be impacted: - io.buji:buji-pac4j-core =1.4.2, =1.4.2, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr7 - org.pac4j:pac4j-cas 1.8.7 -...

Exposed Git repository detection

Detects publicly accessible Git metadata such as /.git/HEAD or /.git/config. !/usr/bin/env python3 -- coding: utf-8 -- """Detect publicly accessible Git metadata /.git/HEAD, config, index, ….""" from kittysploit import from lib.protocols.http.httpclient import Httpclient PROBEPATHS = "/.git/HEAD"...

Malicious code in solanakit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3e8770458eab636335241e359b6cee149cc00640fb2418b4462c89ec88accc93 During import, the code downloads and starts a malicious package hosted on GitHub. It then first ensures persistency e.g., through the autostart registry key...

MAL-2026-2837 Malicious code in solanakit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3e8770458eab636335241e359b6cee149cc00640fb2418b4462c89ec88accc93 During import, the code downloads and starts a malicious package hosted on GitHub. It then first ensures persistency e.g., through the autostart registry key...