CVE-2025-51859

CVE-2025-51859 Vulnerability description Chaindesk, a web application for constructing AI Agents, is vulnerable to Stored Cross-Site Scripting XSS in its agent chat component. An attacker can achieve arbitrary client-side script execution by crafting an AI agent whose system prompt instructs the...

CVE-2026-27886-PoC-Account-Takeover

CVE-2026-27886 Автоматический эксплойт - Руководство по использованию Что делает этот скрипт Автоматизирует полную цепочку захвата учетной записи в 4 группах HTTP-запросов: 1. Проверка уязвимости - Подтверждает, что цель уязвима 2. Перебор email - Извлекает email администратора через булевый...

CVE-2025-51858

CVE-2025-51858 Descrição da vulnerabilidade ChatPlayground.ai é um aplicativo web popular para comparar modelos de IA. Existe uma vulnerabilidade de Cross-Site Scripting XSS no componente de chat. Isso pode levar ao roubo de token JWT e ao sequestro remoto de contas. Além disso, o endpoint...

CVE-2026-81029

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback request parameter and stores it in the HTTP session without comparing it against any configured or registered destination, and the assertion consumer...

CVE-2026-45745

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop Electron disables TLS certificate validation, allowing a machine-in-the-middle attacker to intercept and modify HTTPS traffic to the configured...

CVE-2026-42239

Budibase (backend-core, budibase:auth cookie) is affected prior to version 3.35.10. The issue is that the budibase:auth cookie is set HTTPOnly: false, lacks secure: true and sameSite, allowing access to the JWT session token via document.cookie. This enables any XSS to escalate to full account ta...

AIBOX Cross Site Scripting

AIBOX is a web application for exploring AI consulting and trying out multiple LLMs. It allows users to chat with various LLMs. A reflected cross site scripting XSS vulnerability exists in the chat component, which could lead to JWT token theft and remote account hijacking...

next-auth security vulnerability

next-auth is the complete open source authentication solution for Next.js applications. A security vulnerability exists in versions of next-auth prior to 4.24.5, which stems from an attacker being able to obtain a NextAuth.js-issued JWT from an interrupted OAuth login process status, PKCE, or...