CVE-2026-15474

CVE-2026-15474 affects Eleveo Call Recording Software 9.7.0. The vulnerability resides in the /callrec/audio.jsp component of the Call Recording Handler, where manipulating the argument callId leads to improper authorization. The issue is exploitable remotely, and public exploit code/attack mater...

PT-2026-57527

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-821DAP version 1.12B01 Description A buffer overflow can be triggered remotely via the nslookup target argument in the sub 41EC14 function within the /goform/tools nslookup file of the ssi component. This issue affects products th...

PT-2026-57539

A flaw has been found in AMTT Hotel Broadband Operation System 1.0. Impacted is an unknown function of the file manager/network/switch status.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published an...

PT-2026-57532

Name of the Vulnerable Software and Affected Versions TRENDnet TEW-821DAP version 1.11B03 Description An OS command injection flaw exists in the Firmware Update Handler component. A remote attacker can trigger this issue by manipulating the Hostname argument within the sub 41FBD0 function of the...

GHSA-5R2Q-3WG3-57M2 Duplicate Advisory: PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fj8f-m44g-c479. This link is maintained to preserve external references. Original Description PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaul...

Duplicate Advisory: PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fj8f-m44g-c479. This link is maintained to preserve external references. Original Description PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaul...

CVE-2026-10041

The CVE-2026-10041 entry concerns the WCFM – Frontend Manager for WooCommerce WordPress plugin (versions

EUVD-2026-43131

The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the deserialization process. An attacker can...

Large Language Models in Misinformation Ecosystems: Misuse, Defense, and Vulnerability

Large language models LLMs have transformed misinformation from a primarily content-centric problem into a broader ecosystem-level security challenge. When misused, LLMs create risks beyond false content generation, enabling attacks on the social contexts, evidence sources, retrieval corpora, and...

PT-2026-57410

The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is due to the web hook process paypal standard IPN handler selecting its PayPal validation endpoint from the attacker-controlled $ REQUEST'te...

CVE-2026-61439: Initialization of a Resource with an Insecure Default

PraisonAI versions before 4.6.78 contain a prompt injection defense misconfiguration where the block threshold defaults to CRITICAL severity, allowing HIGH-level threats to pass through unblocked. Attackers can submit single-vector prompt injection attacks such as instruction overrides or financi...

WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.27 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Vendor Data Manipulation vulnerability

Authenticated Subscriber+ Missing Authorization to Arbitrary Vendor Data Manipulation vulnerability discovered by mrholmes, papadope in WordPress Plugin WCFM – Frontend Manager for WooCommerce versions = 6.7.27...

Incorrect Authorization

Overview FlaskBB is an A classic Forum Software in Python using Flask. Affected versions of this package are vulnerable to Incorrect Authorization via manipulation of the topicid parameter in batch requests. An attacker can perform unauthorized actions such as locking, unlocking, deleting, or...

CVE-2026-15373

A vulnerability was detected in Eleveo Call Recording Software 9.7.0. The impacted element is an unknown function of the file /callrec/userAddAction.do. Performing a manipulation of the argument role results in improper authorization. It is possible to initiate the attack remotely. The exploit is...

GHSA-JXJ7-G6GM-49J7 tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies

Summary tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie. Details tarteaucitron.cookie.purge is called on any...

CVE-2026-15373

CVE-2026-15373 affects Eleveo Call Recording Software 9.7.0. The vulnerability lies in an unknown function of the file /callrec/userAddAction.do, where manipulating the argument role enables improper authorization. It can be started remotely, and the exploit is public. Vendor response was not pro...

CVE-2026-22659 FlaskBB Authorization Bypass via Topic ID Manipulation

FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted...

CVE-2026-22659

FlaskBB up to version 2.2.0 is vulnerable to an authorization bypass. The issue arises when an attacker manipulates a batch request with crafted topic ID lists, causing a low-ID topic from a permitted forum to be used as an anchor and bypass the permission check applied only to the first result. ...

CVE-2026-22659 FlaskBB Authorization Bypass via Topic ID Manipulation

FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted...