Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization in the GET /api/tasks and POST /api/tasks/stop/taskid endpoints, which lack proper ownership checks. An attacker can enumerate and terminate background tasks belonging to other users by...

CVE-2026-24662

creationtimestamp| type| source ---|---|--- 2026-05-14 20:00:00+00:00| seen| https://jvn.jp/en/jp/JVN69128376 2026-05-15 07:25:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlusjavsrk2i...

CVE-2026-45147 SiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, POST /api/tag/getTag is registered with model.CheckAuth only, omitting both model.CheckAdminRole and model.CheckReadonly, despite the handler performing a configuration write that is normally guarded by both. Any...

CVE-2026-8584

creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:56:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltsqdeozq2e 2026-05-17 18:00:00+00:00| seen|...

CVE-2026-8583

creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:46:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlts673t6w2o...

CVE-2026-8575

creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:29:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltr7hslhl2i 2026-05-17 18:00:00+00:00| seen|...

CVE-2026-8578

creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:37:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltrmr5sjx2q 2026-05-17 18:00:00+00:00| seen|...

CVE-2026-8577

creationtimestamp| type| source ---|---|--- 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260515 2026-05-14 21:33:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltrfp5un52t 2026-05-17 18:00:00+00:00| seen|...

CVE-2026-42159

creationtimestamp| type| source ---|---|--- 2026-05-14 17:59:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltfhkplug2k...

CVE-2026-44501

creationtimestamp| type| source ---|---|--- 2026-05-14 17:29:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mltdt2yqwz2v...

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

Cisco Talos is tracking the active exploitation of CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage. Successful exploitation of CVE-2026-20182 allows an unauthenticated,...

Kimsuky targets organizations with PebbleDash-based tools

Over the past few months, we have conducted an in-depth analysis of specific activity clusters of Kimsuky aka APT43, Ruby Sleet, Black Banshee, Sparkling Pisces, Velvet Chollima, and Springtail, a prolific Korean-speaking threat actor. Our research revealed notable tactical shifts throughout...

WordPress InfusedWoo Pro plugin <= 5.1.2 - Unauthenticated Missing Authorization to Arbitrary Post Deletion vulnerability

Unauthenticated Missing Authorization to Arbitrary Post Deletion vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin InfusedWoo Pro versions = 5.1.2...

CVE-2026-8280

creationtimestamp| type| source ---|---|--- 2026-05-14 09:32:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlsj4fwudh2n 2026-05-14 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/gitlab-multiple-vulnerabilities20260515...

CVE-2026-6206

The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 via the getpostpropertyfromquerystring function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract da...

CVE-2026-6512

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete...

CVE-2026-41702

creationtimestamp| type| source ---|---|--- 2026-05-14 08:48:40+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/broadcom-vmware-security-advisory-av26-469 2026-05-14 16:03:46+00:00| seen| https://bsky.app/profile/boredchilada.bsky.social/post/3mlt6yuhbo72f 2026-05-15 07:33:35+00:00| seen|...

EUVD-2026-30262

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete...

CVE-2026-6512 InfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete...

CVE-2026-6512

The InfusedWoo Pro plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete...