CVE-2026-61440 PraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints

PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and add or remove labels on owner-created issues. Attackers with workspace member privileges can exploit PATCH and POST/DELETE endpoints to...

EUVD-2026-44641

PraisonAI before 4.6.78 contains an authentication bypass in the Call API agent invocation endpoints src/praisonai/praisonai/api/agentinvoke.py when PRAISONAICALLAUTH=disabled is configured. The safeguard intended to restrict the disabled-auth opt-out to localhost binding derives the bind host fr...

EUVD-2026-44622

Authorization Bypass Through User-Controlled Key CWE-639 in the Excel import handlers CustomerImport, LeadImport, ProductImport in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create customer, lead, and product records inside another company...

MAL-2026-10680 Malicious code in syncgrove (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c96b3528ab792944d243b00ae61facc33740850b5cb2ed19671fd6732e43494 The package's postinstall lifecycle script contacts a hardcoded plain-HTTP endpoint at http://player.sweeprovider.org, retrieves a key via /getKey.ph...

MAL-2026-10675 Malicious code in ac-raf-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a9d9e454c08fdafa531ee74a3bc52513d5bc39413810db4a6371494872984f8 package.json declares a preinstall lifecycle script that runs curl -X POST against a hardcoded webhook.site collector URL...

Uncontrolled Resource Consumption

github.com/spectolabs/hoverfly is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to the use of http.DefaultClient without a configured timeout for remote post-serve actions, which allows an attacker to trigger requests to a non-responsive endpoint,...

CVE-2026-12281

creationtimestamp| type| source ---|---|--- 2026-07-15 08:23:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqoc76djrl22 2026-07-15 12:00:16+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqoockgock2y...

CVE-2026-12512

creationtimestamp| type| source ---|---|--- 2026-07-15 08:18:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqobw65kbh2w 2026-07-15 12:00:10+00:00| seen| https://bsky.app/profile/pulse-wp.com/post/3mqoocffj5p2e 2026-07-15 12:44:11+00:00| seen|...

CVE-2026-15583

creationtimestamp| type| source ---|---|--- 2026-07-15 08:17:28+00:00| seen| https://bsky.app/profile/suriq.io/post/3mqobu5nz4y2w 2026-07-17 16:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/93844 2026-07-17 22:00:05+00:00| published-proof-of-concept|...

CVE-2026-35152

creationtimestamp| type| source ---|---|--- 2026-07-15 06:55:57+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqo5cffab52h 2026-07-15 13:12:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqoseeru4y2c 2026-07-16 10:37:06+00:00| seen|...

CVE-2026-11580

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...

CVE-2026-11580

The CVE covers Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin prior to 2.4.17. The root cause is a missing per-object capability check in the post-duplication AJAX action, enabling users with Contributor-level access or higher to duplicate any post (regardless of owner, post t...

EUVD-2026-44593

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...

CVE-2026-11580 Kali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDOR

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...

CVE-2026-11580

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post regardless of owner, post type, or status into a...

CVE-2026-31837

creationtimestamp| type| source ---|---|--- 2026-07-15 04:34:38+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqnvfpbgnk2w...

CVE-2026-48260

creationtimestamp| type| source ---|---|--- 2026-07-15 03:50:17+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mqnswen63h2q...

CVE-2026-48254

creationtimestamp| type| source ---|---|--- 2026-07-15 03:50:15+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mqnswdihda2t...

CVE-2026-47998

creationtimestamp| type| source ---|---|--- 2026-07-15 03:50:13+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mqnswby5gi2t...

CVE-2026-13585

creationtimestamp| type| source ---|---|--- 2026-07-15 03:43:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnsjokhz42c 2026-07-15 16:45:09+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-16 06:28:08+00:00| seen|...