125 matches found
CVE-2026-86259
CVE-2026-86259 - OpenMAIC 1.0.0: Unauthenticated Outbound SSRF to Cloud Metadata Service via Fail-Open Middleware and Environment-Gated Validation Bypass Overview Verified. A two-leg exploit chain exists in OpenMAIC's authentication middleware and outbound provider request layer that allows an...
DSGN: A Dual-Stream Gated Network for Scalable Simultaneous Surveillance and Containment
The simultaneous surveillance and containment SSC problem arises in multi-robot applications such as perimeter security and environmental monitoring, where robots must survey a region of interest and coordinate to enclose targets once they are detected. Surveillance favors spatial dispersion for...
CVE-2026-115477
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with "auth.jwtSecret" configured and a 2026-07-28-era client declaring "elicitation.form" support, a dispatch-gated tool call offered an...
CVE-2026-110527
The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment...
EUVD-2026-103257
The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment...
CVE-2026-110527: Improper Access Control
The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment...
PT-2026-116370
Name of the Vulnerable Software and Affected Versions WP User Manager versions prior to 2.9.20 Description An issue exists during payment-gated registration where the software fails to roll back the creation of a WordPress account if the subsequent payment step fails. This allows unauthenticated...
PT-2026-109132
Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to gated content...
CVE-2026-79618 WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately publish posts...
CVE-2026-103269
Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to gated content...
EUVD-2026-90663
Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to gated content...
CVE-2026-103269 Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts
Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to gated content...
CVE-2026-103269
Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to gated content...
CVE-2026-103269 Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts
Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to gated content...
PT-2026-103802
Name of the Vulnerable Software and Affected Versions Ghost versions 5.3.0 through 6.61.0 Description An authorization flaw allows an authenticated site member to read excerpts of posts they are not permitted to access, specifically affecting gated content. Recommendations Update Ghost to version...
CVE-2026-103269: Missing Authorization
Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to gated content...
Proof-Gated Signing: Solver-Checked Transaction Guards That Hold under State Drift for Onchain AI Agents
AI agents that control wallets read attacker-reachable content, so they can be steered into proposing harmful transactions. The usual last line of defense is a pre-signing check: a static allowlist, an LLM reviewer, or a transaction simulation. All three share a gap: the check describes the chain...
BadEngram: Backdoor Attack on Gated Memory Components in LLMs
To expand open-weight models' capacity without proportionally increasing computation, recent language models incorporate gated parametric memories that retrieve learned values and inject them into intermediate representations. Despite these efficiency benefits, such modules create a distinct atta...
CVE-2026-86259 OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud...
