445 matches found
CVE-2026-76072
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts...
EUVD-2026-65059
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts...
CVE-2026-76072
Continue CLI through 1.5.47 uses an incomplete denylist in evaluateTerminalCommandSecurity.ts as its sole barrier against destructive shell commands in headless and auto modes. The dangerous-path check covers only /, ~, /usr, /etc, /bin, and /sbin, leaving paths like /home, /root, /var, /opt, and...
CVE-2026-76072 Continue CLI through 1.5.47 Incomplete Destructive Command Denylist in Headless and Auto Mode
The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode and auto mode the default policy in extensions/cli/src/permissions/defaultPolicies.ts grants the Bash tool the allow permission, and permissionChecker.ts...
CVE-2026-28149
Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...
CVE-2026-28148
Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...
CVE-2026-28149
Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...
CVE-2026-28149 WordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...
EUVD-2026-57947
Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...
CVE-2026-28149
The CVE-2026-28149 entry covers an Unauthenticated PHP Object Injection in the WordPress Headless Single Sign On plugin versions <= 1.6. The underlying issue is a PHP object injection vulnerability that can be exploited without authentication, leading to high impact on confidentiality, integri...
CVE-2026-28148
Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...
CVE-2026-28148 WordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...
CVE-2026-28148
CVE-2026-28148 affects the WordPress Headless Single Sign On plugin (versions 1.6 and earlier). The vulnerability is an unauthenticated bypass that could allow an attacker to bypass authentication, with CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8, CRITICAL). Connected records do ...
EUVD-2026-57946
Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...
PT-2026-71512
Unauthenticated Bypass Vulnerability in Headless Single Sign On = 1.6 versions...
PT-2026-71513
Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...
EUVD-2026-51545
Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...
CVE-2026-17883
A flaw was found in Google Chrome's Headless mode. A remote attacker could exploit this vulnerability by tricking a user into visiting a specially crafted HTML page. This could allow the attacker to bypass the Same-Origin Policy SOP, a security mechanism that prevents web pages from interacting...
SUSE CVE-2026-17883
Inappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...
DEBIAN-CVE-2026-17883
Inappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...