PT-2026-68309

Name of the Vulnerable Software and Affected Versions Milvus versions 2.6.22 through 3.0.0 Description An unauthenticated denial of service issue exists that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. The...

PT-2026-68039

Name of the Vulnerable Software and Affected Versions Xpro Addons versions prior to 1.5.2 Description The Xpro Addons plugin for WordPress contains a flaw allowing unauthorized data creation due to a missing capability check in the get menu content editor function. Authenticated users with...

PT-2026-68323

Name of the Vulnerable Software and Affected Versions Spacebar Server versions prior to commit 51da17c Description An authorization flaw allows authenticated users to enumerate the complete membership of a guild. By querying the 'GET /guilds/guild id/roles/role id/member-ids' endpoint, an attacke...

PT-2026-68321

Name of the Vulnerable Software and Affected Versions boringproxy versions prior to 0.10.1 Description An authenticated user can cause resource exhaustion by sending requests to the 'GET /loading' endpoint using a malicious id query parameter. The issue occurs because the handler lacks a map-look...

CVE-2026-71273: Cross-Site Request Forgery (CSRF)

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string...

CVE-2026-71293: Exposure of Sensitive Information to an Unauthorized Actor

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...

CVE-2026-70616: Deadlock

boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler...

PT-2026-68306

Name of the Vulnerable Software and Affected Versions Amazon awslabs.aws-transform-mcp-server versions 0.1.0 through 0.1.4 Description Improper limitation of a pathname to a restricted directory in the get resource tool allows a context-dependent actor to write arbitrary files outside the intende...

The vulnerability of the Config.get_value() function in the Glances monitoring tool allows a malicious actor to escalate their privileges.

The vulnerability of the Config.getvalue function in the Glances monitoring tool is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability can allow attackers to enhance their privileges...

py-djangorestframework -- two vulnerabilities

Bruno Alla reports: Potential bypass of Django DATAUPLOADMAXMEMORYSIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data AdminRenderer may disclose GET-protected data when rendering invalid write requests...

MAL-2026-11540 Malicious code in hubert-application-get-document-preview-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e887ef3c3509ebfe43d231ff354e4e0d7f8eb20c9da05389324446d44fc589 On require of the package, index.js loads setup.js which selects a platform key, downloads a native binary from one of four hardcoded workers.dev...

Server-side Request Forgery (SSRF)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ImageSize.fetchImageSizeFromUrl path in core/server/lib/image/image-size.js. An attacker can make Ghost send blind HTTP GET requests to internal hosts by supplying ...

CVE-2026-13227

An Improper Authorization vulnerability exists in ERPNext version v16.25.0 and 15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.getopportunities. This issue affects ERPNext: before 15.115.0, before 16.26.0...

CVE-2026-13227 ERPNext v16.25.0 - Improper authorization in Prospect opportunities API

An Improper Authorization vulnerability exists in ERPNext version v16.25.0 and 15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.getopportunities. This issue affects ERPNext: before 15.115.0, before 16.26.0...

EUVD-2026-52924

An Improper Authorization vulnerability exists in ERPNext version v16.25.0 and 15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.getopportunities. This issue affects ERPNext: before 15.115.0, before 16.26.0...

Server-side Request Forgery (SSRF)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the renderVegaVisualization process. An attacker can cause a victim's browser to make arbitrary outbound GET requests and read responses from same-origin or CORS-permissiv...

CVE-2026-69703

Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espaceadmin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actio...

EUVD-2026-52868

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...

CVE-2026-69704

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...

CVE-2026-69703 Atlas-Livre Unauthenticated Access via Admin Controllers Missing Exit

Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espaceadmin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actio...