CVE-2026-108818

A vulnerability exists in agno-agi agno versions up to 2.7.3/3.0.6 within the auth.py file. Specifically, the get_authentication_dependency function is susceptible to missing authentication when the security_key argument is manipulated. This flaw can be exploited remotely. While the project was n...

CVE-2026-108818 agno-agi agno auth.py get_authentication_dependency missing authentication

A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function getauthenticationdependency of the file auth.py. Such manipulation of the argument securitykey leads to missing authentication. The attack may be launched remotely. The exploit is publicly available and...

CVE-2026-108818 agno-agi agno auth.py get_authentication_dependency missing authentication

A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function getauthenticationdependency of the file auth.py. Such manipulation of the argument securitykey leads to missing authentication. The attack may be launched remotely. The exploit is publicly available and...

EUVD-2026-97303

A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function getauthenticationdependency of the file auth.py. Such manipulation of the argument securitykey leads to missing authentication. The attack may be launched remotely. The exploit is publicly available and...

EUVD-2026-97297

Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4...

EUVD-2026-97296

Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users for WooCommerce: from n/a through 0.7...

CVE-2026-103356

Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15...

EUVD-2026-97292

Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1...

EUVD-2026-97291

Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15...

CVE-2026-107430

The VideoWhisper Site Manager for ChatGPT, Claude, Codex WordPress plugin is vulnerable to Broken Access Control (CWE-862) due to incorrectly configured access control security levels . This missing authorization vulnerability affects versions up to and including 1.2.10 . The impact allows for th...

EUVD-2026-97290

Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex: from n/a through...

CVE-2026-109622: Missing Authorization

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints to modify data beyond their permitted role, compromising da...

CVE-2026-109171: Missing Authorization

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAuthorize and approver checks are commented out, attackers ca...

Rocky Linux 8.6 [CIQ] Security Update: texlive / texlive-adjustbox / texlive-ae / texlive-algorithms / etc (ciqsa-2026_1610)

The Rocky Linux 8.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261610 advisory. This advisory aggregates security fixes for the texlive SRPM in CIQ LTS 8.6. It addresses 1 CVE: CVE-2018-17407. Tenable has extracted the preceding description...

RHEL 10 : flatpak (RHSA-2026:80498)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:80498 advisory. Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fixes: flatpak: Flatpak:...

Rocky Linux 9.6 [CIQ] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl (ciqsa-2026_1635)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the CIQ ciqsa-20261635 advisory. This advisory aggregates security fixes for the openssl SRPM in CIQ LTS 9.6. It addresses 1 CVE: CVE-2024-12797. Tenable has extracted the preceding description...

Fedora 44 : python3.11 (2026-f105922543)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-f105922543 advisory. New version of the Python interpreter Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

PT-2026-111067

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.119.0 Frappe ERPNext versions 16.x prior to 16.31.0 Description Authenticated attackers can trigger transactional emails for documents they are not permitted to read because certain endpoints fail to verify ...

PT-2026-111077

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.112.0 Description Authenticated users with a common operational role can modify records beyond their assigned permissions. This occurs due to missing validation in certain endpoints, allowing attackers to...

CVE-2026-109562: Missing Authorization

SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage...