EUVD-2026-72043

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the...

CVE-2026-18056 HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the...

CVE-2026-18056: Improper Authentication

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the accesstoken parameter in all versions up to, and including, 1.1.4. This is due to the authenticateuser function's Facebook authenticator resolving third-party identity by forwarding the...

kin v0.6.4

A new foundation for code. Kin is a graph-native code repository for people and AI agents. It stores source, recorded code relationships, and versioned history as repository state. The graph is the repository model, not a search index maintained beside another repository. Functions, types, and th...

EUVD-2026-70817

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack...

CVE-2026-85241

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack...

GHSA-VPJW-WF5H-CGPQ SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

CVE: This vulnerability corresponds to CVE-2026-72804. Summary getGraph and getLocalGraph filter reader sessions against the visibility tier only and never check the publish password. Password-protected documents are Visible = true, so their graph nodes survive the filter and graph nodes are...

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

CVE: This vulnerability corresponds to CVE-2026-72804. Summary getGraph and getLocalGraph filter reader sessions against the visibility tier only and never check the publish password. Password-protected documents are Visible = true, so their graph nodes survive the filter and graph nodes are...

CVE-2026-85241

SpecterOps BloodHound versions up to 9.5.1 are affected by an improper authorization flaw in the Graph Write Endpoint , specifically in the function NewV2API located in cmd/api/src/api/registration/v2.go. A remote attacker with low privileges can manipulate this endpoint, resulting in low impacts...

CVE-2026-85241 SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack...

CVE-2026-85241 SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack...

CVE-2026-85241 SpecterOps BloodHound Graph Write Endpoint v2.go NewV2API improper authorization

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack...

CVE-2026-56126

pfSense Plus before 26.07 and CE before 2.9.0 contain a stored cross-site scripting (XSS) vulnerability in /status_monitoring.php . Authenticated users holding the Status: Monitoring privilege can inject arbitrary JavaScript by supplying unsanitized values in multiple POST parameters (e.g., graph...

EUVD-2026-70495

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /statusmonitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date...

IDAssist v2.3.0

IDAssist AI-Powered Reverse Engineering Plugin for IDA Pro Author: Jason Tang Description IDAssist is an IDA Pro plugin that integrates LLM-powered analysis directly into IDA's interface, providing AI-assisted binary reverse engineering through configurable LLM providers, semantic knowledge graph...

CVE-2026-56126: Improper Neutralization of Input During Web Page Generation

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /statusmonitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date...

CVE-2026-85241: Improper Authorization

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack...

PT-2026-85272

A weakness has been identified in SpecterOps BloodHound up to 9.5.1. The affected element is the function NewV2API of the file cmd/api/src/api/registration/v2.go of the component Graph Write Endpoint. Executing a manipulation can lead to improper authorization. It is possible to launch the attack...

PT-2026-85051

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-dat...

GO-2026-6317 ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption in oras.land/oras

ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption in oras.land/oras...