CVE-2026-65590: Improper Neutralization of Special Elements used in an OS Command

n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package sandboxing was applied only on macOS. Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access t...

Adobe Experience Manager XSS

The vulnerability of the Adobe Media Encoder application relates to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS using the DOM...

PT-2026-84875

Уязвимость сервиса input-remapper.service инструмента для управления устройствами ввода input-remapper связана с отсутствием авторизации. Эксплуатация уязвимости может позволить нарушителю переключить сервис на указанный конфигурационный каталог и запустить механизм инъекции ввода...

ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation

A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized remote attacker to cause a Denial of Service DoS by allocating resources without proper limits or throttling. This can lead to the affected system becoming unresponsive or unavailable to legitimate users...

ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation

A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized remote attacker to cause a Denial of Service DoS by allocating resources without proper limits or throttling. This can lead to the affected system becoming unresponsive or unavailable to legitimate users...

PT-2026-82343

Уязвимость модуля «КОМТЕТ Касса Курьер» системы управления содержимым сайтов CMS 1С-Битрикс: Управление сайтом связана с отсутствием аутентификации для критичной функции. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на целостность и доступность...

Honeywell IQ4 PLC Authentication Bypass

The vulnerability of the microprogrammed software in Honeywell IQ4 programmable logic controllers is related to the absence of authentication for a critical function. Exploiting this vulnerability can allow an attacker operating remotely to gain full access to the device...

CVE-2026-57206 SimpleChat plugin validation endpoints missing authentication and authorization

SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin validation routes in application/singleapp/pluginvalidationendpoint.py, including POST /api/admin/plugins/test-instantiation, GET...

MINI-VW5C-9VXP-W78X

Bulletin has no description...

Duplicate Advisory: PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xxgv-vgvj-qvxh. This link is maintained to preserve external references. Original Description PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace membe...

GHSA-VP55-5C2V-3597 Duplicate Advisory: PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xxgv-vgvj-qvxh. This link is maintained to preserve external references. Original Description PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace membe...

Microsoft SharePoint Server Privilege Escalation

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and Microsoft SharePoint Enterprise Server lies in the absence of authentication for a critical function. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...

CVE-2026-52837: Exposure of Sensitive Information to an Unauthorized Actor

Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at /index.php/booking/reschedule/appointmenthash handled by Booking::index embeds the entire customer record as inline JavaScript const vars = ... "customerdata": ...,...

PYSEC-2026-2763 Open WebUI: Forged chat-file link allows cross-user file read and deletion

Summary Open WebUI v0.9.5 lets an authenticated user attach arbitrary fileid values to their own chat message without checking whether they own or can read those files. If the attacker then shares that chat and grants themselves read access, hasaccesstofile treats the victim file as accessible...

PYSEC-2026-2932 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

Summary Type: Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on requireworkspacememberworkspaceid only, then resolve projectid through ProjectService.getprojectid / updateprojecti...

MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability

ImpactCritical Sandbox Escape & Server Takeover:A critical security vulnerability exists in mcp-run-python due to a lack of isolation between the Python runtime Pyodide and the host JavaScript environment.The runPython and runPythonAsync functions execute Python code using Pyodide without...

Duplicate Advisory: PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qj9c-59p6-8cgx. This link is maintained to preserve external references. Original Description PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated...

GHSA-4MP6-8448-9VGV Duplicate Advisory: PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qj9c-59p6-8cgx. This link is maintained to preserve external references. Original Description PraisonAI AgentMail versions before 4.6.78 lack signature verification in webhook mode, allowing unauthenticated...

MINI-RG82-P268-7P5P

Bulletin has no description...

CVE-2025-27463 WinPVDrivers: Excessive permissions on user-exposed devices

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. The...