CVE-2026-84857: Memory Allocation with Excessive Size Value

A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API Endpoint. This manipulation causes uncontrolled memory allocation. The attack can be initiated remotely. The exploit has been published and may be used. The vendor...

CVE-2026-78588: Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling CWE-770 in Filebeat can lead to a denial of service via Excessive Allocation CAPEC-130. An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memory resources of the...

Hikvision CSMP iSecure Center Arbitrary Command Execution

The vulnerability of the integrated security management platform Hikvision CSMP iSecure Center lies in the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands in JSON data...

Langflow 1.10.0 - RCE

Exploit Title: Langflow 1.10.0 - RCE Exploit Author: Richard Howe Vendor Homepage: https://www.langflow.org/ Software Link: https://www.langflow.org/desktop Version: str: endpoint = '/api/v1/autologin' headers = 'Content-Type': 'application/json', try: resp = getbaseurl + endpoint except Exceptio...

Switchvox pa endpoint SQL injection

Added: 09/02/2026 CVE: CVE-2026-9586 Background Switchvox is a VoIP and Unified Communications phone system. Problem An SQL injection vulnerability exposed by the unauthenticated /pa endpoint could allow a remote attacker to execute arbitrary commands. Resolution Upgrade to Switchvox 8.4.0.2 or...

PT-2026-84587

APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names, email addresses, and team hierarchy. Attackers can query the endpoint with space identifiers obtained from shared links or...

PT-2026-84667

Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset...

PT-2026-84675

Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrie...

PT-2026-84892

This islandora advanced search sub module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn't sufficiently check block access when arbitrary block ID's are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to...

PT-2026-84886

This module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn’t sufficiently check block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block conten...

Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126

This islandoraadvancedsearch sub module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn't sufficiently check block access when arbitrary block ID's are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to...

Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118

This module enables AJAX updates for advanced search, facet, and search result blocks. The module doesn’t sufficiently check block access when arbitrary block IDs are submitted to its publicly accessible AJAX endpoint. This may allow an unauthenticated attacker to retrieve restricted block conten...

CVE-2026-84430: Improperly Controlled Modification of Dynamically-Determined Object Attributes

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update of the file app/home/controller/Index.php of the component editpersonal Endpoint. Such manipulation of the argument positionid leads to dynamically-determined object attributes...

CVE-2026-84840: Missing Authentication for Critical Function

A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file InterceptingFilter.java of the component Bootstrap Setup Endpoint. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly availabl...

PT-2026-84681

Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enforce activity-team access controls. Users with view other timesheet permission can list timesheets using activities restricted to teams they do not belong to,...

Missing permission check allows reading build parameters

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not perform an Item/Read permission check in an HTTP endpoint. This allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to. Jenkins 2.580, LTS 2.568.3 performs a...

CSRF vulnerability in pipeline-groovy-lib

pipeline-groovy-lib 798.v5cc688825312 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to delete shared library caches. pipeline-groovy-lib 805.vafc79344957d requires POST requests fo...

PT-2026-84835

In affected versions of Nexus Repository 3, the script execution endpoint POST /service/rest/v1/script/name/run did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an...

PT-2026-84867

Name of the Vulnerable Software and Affected Versions rowboatlabs rowboat versions prior to 0.9.2 Description A remote denial of service issue exists in the Composio Webhook Endpoint component. The problem occurs within the request.text/req.json functions located in the...

CVE-2026-84481

WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns sensitive configuration data to unauthenticated visitors. Attackers can send an unauthenticated GET request to plugin/MobileManager/getConfiguration.json.ph...