CVE-2026-85607 Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router

Blinko 1.8.7 contains an authorization bypass IDOR vulnerability in multiple tRPC procedures message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts. Although these procedures require...

EUVD-2026-71223

Blinko 1.8.7 contains an authorization bypass IDOR vulnerability in multiple tRPC procedures message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts. Although these procedures require...

CVE-2026-85607 Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router

Blinko 1.8.7 contains an authorization bypass IDOR vulnerability in multiple tRPC procedures message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts. Although these procedures require...

CVE-2026-85607

Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts). Although these procedures require ...

CVE-2026-85607 Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router

Blinko 1.8.7 contains an authorization bypass IDOR vulnerability in multiple tRPC procedures message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts. Although these procedures require...

EXPLOIT-CVE-2025-27515

CVE-2025-27515 Proof of Concept A practical demonstration of CVE-2025-27515 , a file upload validation bypass vulnerability in Laravel Framework ≤ 12.0.0. Vulnerability Overview CVE-2025-27515 is a validation bypass that allows attackers to circumvent file upload restrictions when Laravel...

opentaint go-server/latest

The open source taint analysis engine for the AI era Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dan...

CVE-2026-7458

🧨 CVE-2026-7458 – PickPlugins User Verification OTP Bypass Unauthenticated Authentication Bypass via Loose Comparison in OTP Verification REST API PickPlugins User Verification ≤ 2.0.46 📖 Description The User Verification plugin by PickPlugins for WordPress versions ≤ 2.0.46 contains a critical...

CVE-2026-23550

🧨 CVE-2026-23550 – Modular Connector Admin Bypass Unauthenticated WordPress Admin Login viaorigin=mo Parameter Modular Connector Plugin ≤ 2.5.1 📖 Description The Modular Connector plugin for WordPress versions ≤ 2.5.1 contains a critical authentication bypass vulnerability. An unauthenticated...

chyrp-lite-rce-poc

chyrp-lite-rce-poc CVE-2026-53767 + CVE-2026-53768 - Authenticated RCE in Chyrp Lite ≤ 2026.01 "Iriomote" Chained attack: uploadspath blocklist bypass CVE-2026-53768 + missing file extension validation in adminupdateupload CVE-2026-53767 → Remote Code Execution as www-data Overview Chyrp Lite ≤...

CVE-2026-25938-FUXA-Unauthenticated-RCE

CVE-2026-25938 - FUXA Unauthenticated RCE 1. What is FUXA? FUXA is a free, open-source, web-based SCADA Supervisory Control and Data Acquisition and HMI Human-Machine Interface platform used for industrial automation , IoT , and real-time process visualization. It lets users build custom...

CVE-2026-9186

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain an improper access control vulnerability (CWE-284) in the MCP configuration installation endpoint. The endpoint enforces a localhost-only restriction using a client IP helper that blindly trusts the X-Forwarded-For header without verifying th...

EUVD-2026-71215

IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header, enabling arbitrary writes to IDE config files /.cursor/mcp.json, etc...

CVE-2026-9186 Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust

IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header, enabling arbitrary writes to IDE config files /.cursor/mcp.json, etc...

CVE-2026-9186 Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust

IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header, enabling arbitrary writes to IDE config files /.cursor/mcp.json, etc...

Security Bulletin: IBM Decision Intelligence Client Managed Software (Formerly Known as IBM Automation Decision Services) for Aug 2026- Multiple CVEs addressed

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Automation Decision Services. See full list below. Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION: Immutable.js provides many Persistent Immutable data...

linux-malware-detect

Linux Malware Detect LMD Malware scanner for Linux — multi-stage threat detection MD5, SHA-256, HEX, YARA, statistical analysis, ClamAV integration, real-time inotify monitoring, quarantine/clean/restore operations, and multi-channel alerting email, Slack, Telegram, Discord. C 2002-2026, R-fx...

Security Bulletin: The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in DOMPurify

Summary The IBM SPSS Collaboration and Deployment Services impacted by multiple vulnerabilities in DOMPurify. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom...

CVE-2026-35031

CVE-2026-35031: Jellyfin Subtitle Upload Path Traversal to RCE -darkred?style=flat-square -orange?style=flat-square TL;DR A critical path traversal vulnerability in Jellyfin Media Server allows authenticated users with "Upload Subtitles" permission to upload files to arbitrary locations on disk. ...

CVE-2026-41940

CVE-2026-41940 - cPanel/WHM Auth Bypass Scanner & Exploit Tool cPanel/WHM Authentication Bypass Scanner & Exploit Tool for CVE-2026-41940 ⚠️ Disclaimer This tool is provided for educational purposes and authorized security testing only. By using this tool, you agree that: You will only test system...