CVE-2026-47397 PraisonAI has an Arbitrary File Write in Python API

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to arbitrary paths. writefile skips path validation when workspace=None always None in production. Version 4.6.40 fixes the issue...

CVE-2026-65051

Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs...

CVE-2026-65051 Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler

Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs...

CVE-2026-65051

Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs...

CVE-2026-65051

CVE-2026-65051 affects the Ninja Forms WordPress plugin (version 3.14.8). The issue is a client-side enforcement weakness that allows unauthenticated attackers to bypass server-side form validation by merging attacker-controlled field metadata into server-loaded form definitions before validation...

EUVD-2026-46271

Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs...

CVE-2026-65051 Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler

Ninja Forms WordPress plugin version 3.14.8 contains a client-side enforcement of server-side security vulnerability that allows unauthenticated attackers to bypass all form validation by merging attacker-controlled field metadata over server-loaded form definitions before validation runs...

CVE-2026-11876 Missing Authorization in get_deployed_stack Endpoint in zenml-io/zenml

In zenml-io/zenml version 0.94.2, the GET /api/v1/stack-deployment/stack endpoint getdeployedstack lacks proper RBAC authorization checks, allowing any authenticated user to enumerate all deployed stacks across all users and tenants. This includes stack component details, service connector...

Authorization Bypass

Snipe-IT is vulnerable to Authorization Bypass. The vulnerability is due to inadequate authorization checks, where UsersController::show and printInventory authorize only user viewing before loading and rendering assigned license, accessory, and consumable relationships, and an authenticated user...

CVE-2026-64146

A flaw was found in the Linux kernel's EROFS Enhanced Read-Only File System component. During the initialization of inode extended attributes xattrs, certain error conditions can lead to a leak of metadata buffers. This memory leak can result in a denial of service DoS due to resource exhaustion...

CVE-2026-63833

A flaw was found in the Linux kernel's ntfs3 filesystem driver. An unprivileged local user with write access to an ntfs3 mounted filesystem can exploit a vulnerability by directly modifying internal Windows Subsystem for Linux WSL permission metadata. This manipulation allows the user to gain roo...

CVE-2026-64167

A flaw was found in the Linux kernel's kexechandover KHO mechanism. This vulnerability occurs because the khofillkimage function unconditionally populates the kimage with KHO metadata, even when processing a crash kernel. When a crash kernel attempts to initialize KHO memory, it can try to access...

wp-ssrf-cloud-metadata

WordPress Core SSRF via Cloud Metadata Endpoint Bypass in wp...

CVE-2026-15927

A flaw was found in Red Hat Quay's repository-level mirror configuration feature. The POST and PUT handlers in endpoints/api/mirror.py accept an externalreference parameter without SSRF validation, unlike the organization-level mirror handlers which apply validateexternalregistryurl. A repository...

PT-2026-62163

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5 Oracle Enterprise Manager Base Platform version 24.1 Description A flaw in the Metadata Plugin of the Oracle Enterprise Manager Base Platform allows an unauthenticated attacker with network...

PT-2026-61830

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description A flaw exists in the repository-level mirror configuration feature. The POST and PUT handlers in the endpoints/api/mirror.py file accept an external reference parameter without Server-Si...

PT-2026-63314

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated user with package publishing permissions can cause resource amplification by uploading a specially crafted Arch package archive. The system records non-dot regular file entries...

PT-2026-63311

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description Gitea contains an information disclosure issue where requests containing the go-get query parameter with a value of 1 bypass authentication and authorization checks. This behavior is triggered ...

CVE-2026-65054: Incorrect Authorization

MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by adding arbitrary media tokens to their own playlist without access control checks. Attackers can issue a PUT request to the playlist API...

CVE-2026-46997: Missing Authentication for Critical Function

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...