PT-2026-68137

Name of the Vulnerable Software and Affected Versions WLED affected versions not specified Description The software contains two security flaws. First, the 'GET /json/cfg' endpoint calls the serveJson function without verifying the settings-PIN, allowing any unauthenticated client on the network ...

PT-2026-68133

Name of the Vulnerable Software and Affected Versions ESPHome versions prior to 2026.7.0-dev Description The web server component discloses plaintext passwords. In the WebServer::text json function, text entities configured with mode: password have their JSON state field masked, but the raw...

PT-2026-68306

Name of the Vulnerable Software and Affected Versions Amazon awslabs.aws-transform-mcp-server versions 0.1.0 through 0.1.4 Description Improper limitation of a pathname to a restricted directory in the get resource tool allows a context-dependent actor to write arbitrary files outside the intende...

PT-2026-68039

Name of the Vulnerable Software and Affected Versions Xpro Addons versions prior to 1.5.2 Description The Xpro Addons plugin for WordPress contains a flaw allowing unauthorized data creation due to a missing capability check in the get menu content editor function. Authenticated users with...

PT-2026-68165

Name of the Vulnerable Software and Affected Versions Statamic CMS affected versions not specified Description The user-augmentation resolver AugmentedUser::get in src/Auth/AugmentedUser.php contains a case for the two factor recovery codes handle that returns raw two-factor recovery codes withou...

CVE-2026-69111: Missing Authentication for Critical Function

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint,...

CVE-2026-71293: Exposure of Sensitive Information to an Unauthorized Actor

Statamic CMS's user-augmentation resolver, AugmentedUser::get in src/Auth/AugmentedUser.php, contains an explicit case for the handle that returns the user's raw two-factor recovery codes with no access restriction...

CVE-2026-71273: Cross-Site Request Forgery (CSRF)

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string...

CVE-2026-71264: Missing Authorization

WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...

PT-2026-68309

Name of the Vulnerable Software and Affected Versions Milvus versions 2.6.22 through 3.0.0 Description An unauthenticated denial of service issue exists that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. The...

PT-2026-68323

Name of the Vulnerable Software and Affected Versions Spacebar Server versions prior to commit 51da17c Description An authorization flaw allows authenticated users to enumerate the complete membership of a guild. By querying the 'GET /guilds/guild id/roles/role id/member-ids' endpoint, an attacke...

PT-2026-68321

Name of the Vulnerable Software and Affected Versions boringproxy versions prior to 0.10.1 Description An authenticated user can cause resource exhaustion by sending requests to the 'GET /loading' endpoint using a malicious id query parameter. The issue occurs because the handler lacks a map-look...

PT-2026-68018

Name of the Vulnerable Software and Affected Versions TableOn – WordPress Posts Table Filterable versions prior to 1.0.5.2 Description Unauthenticated attackers can perform blind SQL Injection through the filter datacomment count parameter of the public tableon get table data AJAX action. The iss...

CVE-2026-70616: Deadlock

boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler...

py-djangorestframework -- two vulnerabilities

Bruno Alla reports: Potential bypass of Django DATAUPLOADMAXMEMORYSIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data AdminRenderer may disclose GET-protected data when rendering invalid write requests...

The vulnerability of the Config.get_value() function in the Glances monitoring tool allows a malicious actor to escalate their privileges.

The vulnerability of the Config.getvalue function in the Glances monitoring tool is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability can allow attackers to enhance their privileges...

MAL-2026-11540 Malicious code in hubert-application-get-document-preview-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e887ef3c3509ebfe43d231ff354e4e0d7f8eb20c9da05389324446d44fc589 On require of the package, index.js loads setup.js which selects a platform key, downloads a native binary from one of four hardcoded workers.dev...

Server-side Request Forgery (SSRF)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ImageSize.fetchImageSizeFromUrl path in core/server/lib/image/image-size.js. An attacker can make Ghost send blind HTTP GET requests to internal hosts by supplying ...

CVE-2026-13227

An Improper Authorization vulnerability exists in ERPNext version v16.25.0 and 15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.getopportunities. This issue affects ERPNext: before 15.115.0, before 16.26.0...

CVE-2026-13227 ERPNext v16.25.0 - Improper authorization in Prospect opportunities API

An Improper Authorization vulnerability exists in ERPNext version v16.25.0 and 15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.getopportunities. This issue affects ERPNext: before 15.115.0, before 16.26.0...