CVE-2026-89040

Tencent Mass Service Engine in Cluster (MSEC) is affected by a path traversal vulnerability that allows a remote, unauthenticated attacker to send a crafted POST request containing ../, gaining root access on the target device. An attacker who uploads a webshell can then execute arbitrary code as...

CVE-2026-81924

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery CSRF in the theme page-template activation feature. The Dashboard theme Inspect controller's activatefiles action created PageTemplate records from attacker-supplied pageTemplates values without validating an anti-CSRF token.A...

CVE-2026-58483

creationtimestamp| type| source ---|---|--- 2026-09-15 19:11:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ijvgmephozgs4...

Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w39f-h553-h2mx. This link is maintained to preserve external references. Original Description Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task...

Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pqf9-h8g4-8gmh. This link is maintained to preserve external references. Original Description vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate...

GHSA-55P4-8J34-JV53 Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pqf9-h8g4-8gmh. This link is maintained to preserve external references. Original Description vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate...

CVE-2026-63443

creationtimestamp| type| source ---|---|--- 2026-09-15 18:01:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvl7gf4kyf2s...

CVE-2026-21586

creationtimestamp| type| source ---|---|--- 2026-09-15 17:16:49+00:00| seen| https://bsky.app/profile/suriq.io/post/3mvl4vnbals2p...

CVE-2026-89025

creationtimestamp| type| source ---|---|--- 2026-09-15 16:01:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvkyofw5es2b...

CVE-2026-61549

creationtimestamp| type| source ---|---|--- 2026-09-15 15:40:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvkxipc4tt2g...

CVE-2026-91984

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91969

vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row cardinality. Authenticated attackers can upload multipart CSV files with millions of tiny records to exhaust process memory and terminate the...

CVE-2026-91941 Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy

Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial of service. Attackers can select the PDF scraping strategy in POST requests to download large remote PDFs without size or page limits,...

CVE-2026-91924

pgweb versions through 0.17.0 leave the POST /api/connect endpoint unguarded when connect-backend authorization is configured. This allows an attacker with low privileges to supply an arbitrary database connection string, bypassing the intended resource-to-database mapping by providing a custom s...

EUVD-2026-78415

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifier and connection...

CVE-2026-57139 PraisonAI MCPServer exposes unauthenticated HTTP tools/call

PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp in src/praisonai-ts/src/mcp/server.ts binds without a host restriction and forwards every HTTP POST request to handleRequest without authentication or authorization. Any network client that can reach the port can...

CVE-2026-15758 3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...

CVE-2026-91771

creationtimestamp| type| source ---|---|--- 2026-09-15 04:00:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvjqfgnwax2z 2026-09-15 04:02:20+00:00| seen| https://gist.github.com/ichintu/ab20711bf02f5b35c139371e41389621 2026-09-15 12:50:04+00:00| seen|...

HTB-DevHub

HackTheBox — DevHub CVE-2026-23744 | MCPJam Inspector 未认证 RCE 难度： 中等 操作系统： Linux 利用链 root@kitploit: ┌─────────────────────────────────────────────────────┐ │ CVE-2026-23744 │ │ Unauthenticated POST → /api/mcp/connect │ └─────────────────────┬───────────────────────────────┘ ↓ Shell as mcp-dev ↓...

CVE-2026-44300: Improper Input Validation

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...