CVE-2026-18232 WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users...

CVE-2026-91002 stamparm maltrail Blacklist Endpoint httpd.py _blacklist missing authentication

A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function blacklist of the file core/httpd.py of the component Blacklist Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been...

CVE-2026-91002 stamparm maltrail Blacklist Endpoint httpd.py _blacklist missing authentication

A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function blacklist of the file core/httpd.py of the component Blacklist Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been...

EUVD-2026-78274

A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function blacklist of the file core/httpd.py of the component Blacklist Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been...

CVE-2026-91002

stamparm maltrail versions up to 3.0.1 contain a missing authentication flaw in the _blacklist function of core/httpd.py (Blacklist Endpoint). A remote, unauthenticated attacker can manipulate this endpoint, resulting in a low confidentiality impact with no stated integrity or availability impact...

CVE-2026-91002 stamparm maltrail Blacklist Endpoint httpd.py _blacklist missing authentication

A weakness has been identified in stamparm maltrail up to 3.0.1. This vulnerability affects the function blacklist of the file core/httpd.py of the component Blacklist Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been...

CVE-2026-90878

vLLM (vllm-project) versions up to 0.27.1 are affected by a resource consumption vulnerability in the Jinja Template Rendering component of the /v1/chat/completions endpoint. The root cause is manipulation of the chat_template argument, allowing a remote attacker with low privileges to trigger ex...

CVE-2026-91772

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of...

HTB-DevHub

HackTheBox — DevHub CVE-2026-23744 | MCPJam Inspector 未认证 RCE 难度： 中等 操作系统： Linux 利用链 root@kitploit: ┌─────────────────────────────────────────────────────┐ │ CVE-2026-23744 │ │ Unauthenticated POST → /api/mcp/connect │ └─────────────────────┬───────────────────────────────┘ ↓ Shell as mcp-dev ↓...

CVE-2026-91774 Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

CVE-2026-91774

Yao through v1.0.0-rc22 suffers from a missing authorization check on the OpenAPI GET /user/teams/:id endpoint. The endpoint authenticates the caller but fails to verify team membership, allowing any logged-in user who knows a team identifier to retrieve full team records, including name, descrip...

CVE-2026-91774 Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

CVE-2026-91772

Halo through version 2.26.1 is affected by an open redirect vulnerability in the anonymous thumbnail endpoint , which fails to validate the uri query parameter. This allows attackers to craft malicious links on a trusted Halo domain that redirect visitors to arbitrary external sites, enabling phi...

CVE-2026-91772 Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of...

CVE-2026-91772 Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of...

CVE-2026-91772 Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of...

CVE-2026-91750 WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initial SSRF validation by supplying a public URL that redirects to internal networ...

EUVD-2026-78207

GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text,...

EUVD-2026-78223

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...

EUVD-2026-78208

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...