brash

Brash Chromium Browser DoS Attack via document.title Exploitation Brash is a critical vulnerability in Blink , the rendering engine that powers Google's Chromium-based browsers. It allows any Chromium browser to collapse in 15-60 seconds by exploiting an architectural flaw in how certain DOM...

mutiny-fuzzer

Быстрый старт: учебник по Mutiny Статья в блоге: http://blog.talosintelligence.com/2018/01/tutorial-mutiny-fuzzing-framework-and.html Ссылки на демонстрационное видео на YouTube: https://www.youtube.com/watch?v=FZyR6MgJCUs Для дополнительных функций, ориентированных на кампании фаззинга/обратную...

typodetect

TypoDetect This tool gives blue teams, SOC's, researchers and companies the ability to detect the active mutations of their domains, thus preventing the use of these domains in fraudulent activities, such as phishing and smishing. For this, Typodetect allows the use of the latest available versio...

CVE-2026-79991

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

CVE-2026-79991

Craft CMS is affected by an authenticated vulnerability in its GraphQL entry mutation resolvers (saveEntry, deleteEntry). The resolvers read siteId directly from $arguments without passing it through ArgumentManager::prepareArguments(), which normally enforces site-scope filtering via array_inter...

CVE-2026-79991 Authenticated SQL Injection via nested eager-loading criteria

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

CVE-2026-79991 Authenticated SQL Injection via nested eager-loading criteria

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

EUVD-2026-70049

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

EUVD-2026-70048

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via arrayintersect against the GraphQL schema’s allowed sites. The query path...

PT-2026-84745

Craft CMS GraphQL entry mutation resolvers saveEntry, deleteEntry read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments, which is the function that enforces site-scope filtering via array intersect against the GraphQL schema’s allowed sites. The query path...

BIT-GITLAB-2026-19650 Cross-Site Request Forgery (CSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request...

CVE-2026-68457

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SETSPARSE, SETZERODATA and SETCOMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those helpers...

CVE-2026-67621 Flowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints

Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert...

CVE-2026-68578

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via t...

CVE-2026-68578

ArcadeDB before 26.7.3 is affected by an authentication bypass in the MCP HTTP transport: the server does not bind the authenticated principal, causing engine permission checks to pass as no-ops. As a result, non-root MCP-allowed users can perform arbitrary writes, DDL, schema mutations, and run ...

EUVD-2026-47814

Privileged Regular Labs AJAX endpoints did not consistently require valid CSRF tokens, matching component/item permissions and trusted server-generated form configuration. Authenticated lower-privileged users or CSRF attacks could invoke lookups or mutations outside their authorization...

Authorization Bypass

PraisonAI Platform is vulnerable to Authorization Bypass. The vulnerability is due to improper authorization of label and issue-label mutations, where attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to alter shared label taxonomy and manipulate issue-label...

CVE-2026-61440 PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to...

CVE-2026-61440 PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the message mutation handling process. An attacker can perform privileged operations by exploiting misconfigured input paths to bypass requester authorization...