15357 matches found
CVE-2026-27584
Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction...
CVE-2026-27584 ActualBudget server is Missing Authentication for SimpleFIN and Pluggy AI bank sync endpoints
Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction...
Integrating Advanced API Security with Imperva Gateway Environment
As APIs power the majority of modern web applications, implementing robust API security is no longer optional - it’s a critical necessity for data protection. This guide explores how to seamlessly integrate API gateway security into your Imperva on-premises environment to mitigate OWASP Top 10...
PT-2026-21761
Name of the Vulnerable Software and Affected Versions ActualBudget versions prior to 26.2.1 Description A missing authentication check in the ActualBudget server component allows unauthenticated users to access the SimpleFIN and Pluggy.ai integration endpoints. This allows an attacker to read...
pwn-claude-plugin
pwn-claude-plugin Claude Code plugin for binary exploitation...
OpenClaw: What is it and can you use it safely?
An AI tool with a funny name has caused quite a commotion as of late—including some allegations of machine consciousness—so here is a breakdown on OpenClaw. Launched in November 2025, OpenClaw is an open-source, autonomous artificial intelligence AI agent that was made to run locally on your own...
org.apache.camel.quarkus:camel-quarkus-integration-test-keycloak (3.31.0), org.apache.camel.quarkus:camel-quarkus-keycloak (>=3.29.0, <=3.31.0) +2 more potentially affected by CVE-2026-23552 via org.apache.camel:camel-keycloak (>=4.15.0, <=4.17.0)
org.apache.camel:camel-keycloak MAVEN version =4.15.0, =3.29.0, =3.29.0, =4.15.0, =4.17.0 Source cves: CVE-2026-23552 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-15353481...
org.apache.camel.quarkus:camel-quarkus-integration-test-leveldb (>=3.29.0, <=3.31.0), org.apache.camel.quarkus:camel-quarkus-leveldb (>=3.29.0, <=3.31.0) +2 more potentially affected by CVE-2026-25747 via org.apache.camel:camel-leveldb (>=4.15.0, <=4.17.0)
org.apache.camel:camel-leveldb MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.17.0 Source cves: CVE-2026-25747 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-15353482...
org.apache.camel.quarkus:camel-quarkus-integration-test-leveldb (>=3.22.0, <=3.27.2), org.apache.camel.quarkus:camel-quarkus-leveldb (>=3.22.0, <=3.27.2) +2 more potentially affected by CVE-2026-25747 via org.apache.camel:camel-leveldb (>=4.11.0, <=4.14.4)
org.apache.camel:camel-leveldb MAVEN version =4.11.0, =3.22.0, =3.22.0, =3.22.0, =4.11.0, =4.14.4 Source cves: CVE-2026-25747 Source advisory: OSV:GHSA-429Q-MRC4-38FR...
org.apache.camel.quarkus:camel-quarkus-integration-test-leveldb (>=3.29.0, <=3.31.0), org.apache.camel.quarkus:camel-quarkus-leveldb (>=3.29.0, <=3.31.0) +2 more potentially affected by CVE-2026-25747 via org.apache.camel:camel-leveldb (>=4.15.0, <=4.17.0)
org.apache.camel:camel-leveldb MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.17.0 Source cves: CVE-2026-25747 Source advisory: OSV:GHSA-429Q-MRC4-38FR...
org.apache.camel.quarkus:camel-quarkus-integration-test-leveldb (>=3.29.0, <=3.31.0), org.apache.camel.quarkus:camel-quarkus-leveldb (>=3.29.0, <=3.31.0) +2 more potentially affected by CVE-2026-25747 via org.apache.camel:camel-leveldb (>=4.15.0, <=4.17.0)
org.apache.camel:camel-leveldb MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.17.0 Source cves: CVE-2026-25747 Source advisory: MEND:CVE-2026-25747...
org.apache.camel.quarkus:camel-quarkus-integration-test-leveldb (>=3.22.0, <=3.27.2), org.apache.camel.quarkus:camel-quarkus-leveldb (>=3.22.0, <=3.27.2) +2 more potentially affected by CVE-2026-25747 via org.apache.camel:camel-leveldb (>=4.11.0, <=4.14.4)
org.apache.camel:camel-leveldb MAVEN version =4.11.0, =3.22.0, =3.22.0, =3.22.0, =4.11.0, =4.14.4 Source cves: CVE-2026-25747 Source advisory: MEND:CVE-2026-25747...
Directory Traversal
homeassistant is vulnerable to Directory Traversal. The vulnerability is due to insufficient validation of file paths during concatenation in the Downloader integration, which allows an attacker to manipulate paths and access unintended files...
CVE-2025-68834
Missing Authorization vulnerability in Saiful Islam Sync Master Sheet - Product Sync with Google Sheet for WooCommerce product-sync-master-sheet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sync Master Sheet - Product Sync with Google Sheet for...
CVE-2026-24956
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Shahjada Download Manager Addons for Elementor wpdm-elementor allows Blind SQL Injection.This issue affects Download Manager Addons for Elementor: from n/a through = 1.3.0...
Keras Has A Local File Disclosure Via HDF5 External Storage During Keras Weight Loading
Summary TensorFlow / Keras continues to honor HDF5 “external storage” and "ExternalLink" features when loading weights. A malicious ".weights.h5" or a ".keras" archive embedding such weights can direct "loadweights" to read from an arbitrary readable filesystem path. The bytes pulled from that pa...
CVE-2026-26964
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET...
CVE-2026-26316
OpenClaw is a personal AI assistant. Prior to 2026.2.13, the optional BlueBubbles iMessage channel plugin could accept webhook requests as authenticated based only on the TCP peer address being loopback 127.0.0.1, ::1, ::ffff:127.0.0.1 even when the configured webhook secret was missing or...