CVE-2026-14927 FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...

CVE-2026-14927

The FluentCart A New Era of eCommerce WordPress plugin versions prior to 1.5.3 contains an authorization bypass vulnerability. The plugin fails to perform proper authorization or ownership checks when rendering customer order documents that are indexed using sequential numeric identifiers . This ...

CVE-2026-14927

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...

EUVD-2026-51420

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...

PT-2026-66709

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...

CVE-2026-14927: Authorization Bypass Through User-Controlled Key

The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data names,...

CVE-2026-13444

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persistdirectory and collectionname values. The attacker receives exact victim content in their workflow output despite having no...

CVE-2026-13444

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persistdirectory and collectionname values. The attacker receives exact victim content in their workflow output despite having no...

EUVD-2026-51272

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persistdirectory and collectionname values. The attacker receives exact victim content in their workflow output despite having no...

CVE-2026-13444 Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persistdirectory and collectionname values. The attacker receives exact victim content in their workflow output despite having no...

CVE-2026-13444

IBM Langflow OSS versions 1.0.0 through 1.10.1 are vulnerable to a configuration error where an attacker can access another user's private vector documents. By creating a flow with matching Chroma persist_directory and collection_name values, an attacker can retrieve a victim's exact content in t...

CVE-2026-13444

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persistdirectory and collectionname values. The attacker receives exact victim content in their workflow output despite having no...

SUSE CVE-2026-34453

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the publish service exposes bookmarked blocks from password-protected documents to unauthenticated visitors. In publish/read-only mode, /api/bookmark/getBookmark filters bookmark results by calling...

SUSE CVE-2026-45148

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, broken access control in the searchAsset, searchTag, searchWidget, and searchTemplate publish-mode Readers can enumerate metadata from documents that are invisible to the publish service. This vulnerability is fixed in...

Hidden prompt can make Microsoft Copilot spread itself through your Word docs

A security researcher has demonstrated how Microsoft Copilot for Word can be tricked into spreading a self‑propagating prompt‑injection “AI worm.” The attack silently alters documents and embeds its own hidden instructions into newly created files, allowing it to spread through normal...

Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents

Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished file. Håkon Måløy disclosed the technique on July 28, 144 days after reporting it to Microsoft. In his proof of concept, the internally generated fi...

CVE-2026-13444: .NET Misconfiguration: Use of Impersonation

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persistdirectory and collectionname values. The attacker receives exact victim content in their workflow output despite having no...

aws-lambda-sls (0.1.0), chalice (1.6.1) +4 more potentially affected by CVE-2026-13346 via pip (18.0.0)

pip PYPI version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aws-lambda-sls 0.1.0 - chalice 1.6.1 - lucterios =2.3.0.18073018, =2.3.0.18070609, =2.3.0.18070422, =2.3.1.18112821 - venv-update 3.1.1 Source cves:...

CVE-2026-54082 veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerability in PDFAValidator.validate... and GFPDAcroForm.getdynamicRender, where default DocumentBuilderFactory parsing of...

ShinyHunters Claims Ernst & Young (EY) Data Breach, Threatens July 31 Leak

EY confirmed the theft of client tax documents from its third-party support platform. ShinyHunters claims responsibility and is threatening to publish the data...