CVE-2026-71851 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CVE-2026-71851

The CVE-2026-71851 entry describes a vulnerability in crypto-js prior to 4.0.0 where CryptoJS.lib.WordArray.random() uses a non-cryptographically secure PRNG seeded from Math.random(), yielding only 2^39–2^47 entropy. This affects downstream wallets using that entropy for BIP39 recovery phrases, ...

CVE-2026-54218 TeamDavid: Weak Cryptography and Insecure Password Storage

Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server see...

CVE-2026-31221

A flaw was found in PyTorch-Lightning. This vulnerability, categorized as insecure deserialization CWE-502, exists in the checkpoint loading mechanism. A remote attacker can exploit this by providing a maliciously crafted checkpoint file, which, when loaded by the LightningModule.loadfromcheckpoi...

CVE-2026-16263

The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-controlled path before using it in a file inclusion, allowing users with a Subscriber account to include and execute arbitrary existing local PHP files on...

EUVD-2026-54380

The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscriptions for WooCommerce WordPress plugin before 2.0.1 from a user-supplied slug through a nonce-protected AJAX action, allowing users with the Shop Manage...

EUVD-2026-54307

Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/user/update endpoint in UserController.java...

EUVD-2026-54171

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-19111

Insecure direct object reference in the mongodbmemory, elasticsearchmemory, and mem0memory tools in Amazon Strands Agents Tools before 0.8.3 might allow remote authenticated users to access, modify, or delete memories belonging to other tenants by influencing the LLM to emit tool calls with a...

CVE-2026-67622 Flowise 3.1.4 IDOR in OpenAI Assistants Integration

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-67622

Flowise 3.1.4 OpenAI Assistants integration contains an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can access credentials from other workspaces by supplying arbitrary credential UUIDs to Assistants endpoints without workspace ownership verification. Attackers c...

CVE-2026-67622

Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to access credentials belonging to other workspaces by supplying an arbitrary credential UUID to Assistants endpoints without workspace ownersh...

CVE-2026-19111

CVE-2026-19111 affects Amazon Strands Agents Tools’ memory tools (mongodb_memory, elasticsearch_memory, mem0_memory) prior to 0.8.3. The issue is an insecure direct object reference that could allow remote authenticated users to access, modify, or delete memories belonging to other tenants by pro...

CVE-2026-15147

The vulnerability CVE-2026-15147 affects the Five Star Restaurant Reservations WordPress plugin prior to version 2.7.23. The issue is an unauthenticated payment-notification bypass caused by failing to verify the payment recipient, amount, and status, and not binding the notification to the inten...

CVE-2026-28180

Unauthenticated Insecure Direct Object References IDOR in Mercado Pago payments for WooCommerce = 8.9.0 versions...

EUVD-2026-53900

Customer Insecure Direct Object References IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-65523

CVE-2026-65523 affects the WordPress plugin Formidable Forms Signature Online Contract Automation (versions

CVE-2026-65523

Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...

CVE-2026-14314

The CVE concerns the PeproDev WooCommerce Receipt Uploader WordPress plugin (≤ v2.8.0). The root cause is a failure to verify that a requested attachment belongs to the order referenced by its access token, enabling an unauthenticated attacker to forge a token and disclose image attachments, incl...

CVE-2026-67687

The CVE-2026-67687 case concerns ICS-Park Smart Park Management System v2.0 (based on RuoYi). A vertical privilege escalation exists via missing authorization checks in two endpoints: /system/role/save (RoleController.java) and /system/user/update (UserController.java). An authenticated low-privi...