CLSA-2026-1778617167 freeipmi: Fix of CVE-2026-33554

CVE-2026-33554: fix buffer overflows in ipmi-oem response handling for dell get-last-post-code, supermicro extra-firmware-info, and wistron read-proprietary-string subcommands...

EUVD-2026-29568

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint POST /memories. The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending...

mem0 server lacks authentication and authorization controls for its memory creation API endpoint

The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint POST /memories. The endpoint allows unauthenticated users to submit arbitrary memory records without verifying their identity or permissions. A remote attacker can exploit this by sending...

GHSA-R6HF-G5X6-7PV9 Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism

Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the postinstall...

EUVD-2026-29556

Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the postinstall...

Arbitrary Code Injection

Overview guardrails-ai is an Adding guardrails to large language models. Affected versions of this package are vulnerable to Arbitrary Code Injection via the subprocess.checkoutput function. An attacker can execute arbitrary code by publishing a malicious package to the Hub, which is then install...

CVE-2026-31233

Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the postinstall...

WordPress Tutor LMS – eLearning and online course solution plugin <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion vulnerability

Insecure Direct Object Reference to Authenticated Instructor+ Arbitrary Post Deletion vulnerability discovered by molten bit in WordPress Plugin Tutor LMS versions = 3.9.9...

CVE-2026-41293

creationtimestamp| type| source ---|---|--- 2026-05-12 17:15:01+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mloc2ajsvu2j 2026-07-09 22:50:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqapsxsqnv25...

CVE-2026-39534

creationtimestamp| type| source ---|---|--- 2026-05-12 16:35:45+00:00| seen| https://bsky.app/profile/undercode.bsky.social/post/3mlo7u7vfno26...

CVE-2026-8390

creationtimestamp| type| source ---|---|--- 2026-05-12 15:50:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mlo5cthkad2p 2026-05-13 06:28:15+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-per-mozilla-firefox 2026-05-13 06:44:38+00:00| seen|...

CVE-2026-30905

creationtimestamp| type| source ---|---|--- 2026-05-12 15:28:54+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3mlo44fuhc423...

WordPress Blog2Social: Social Media Auto Post & Scheduler plugin <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records vulnerability

Missing Authorization to Authenticated Subscriber+ Delete Arbitrary B2S Post Records vulnerability discovered by awhacken in WordPress Plugin Blog2Social versions = 8.9.0...

CVE-2026-43937

YetAnotherForum.NET YAF.NET is a C ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewrites the response to a 302 to /Info/4. The most impactful abuse is /Admin/RunSql, whose OnPostRunQuery binds Editor from the POST body and...

GHSA-V25V-M36W-JP4H Dalfox Server Mode Vulnerable to Unauthenticated Remote Code Execution via `found-action`

GHSA: Unauthenticated Remote Code Execution via found-action in Dalfox Server Mode Summary When dalfox is started in REST API server mode dalfox server, the server binds to 0.0.0.0:6664 by default and requires no API key unless the operator explicitly passes --api-key. Because model.Options —...

CVE-2026-38566

HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms password change at /profile, candidate deletion at /candidates/delete/, feedback submission at /feedback/add/, interview scheduling at /interviews/add are vulnerable to CSRF. An attacker who can...

CVE-2026-45285

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:50+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-45153

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:29+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxz7ebj62a...

CVE-2026-43321

creationtimestamp| type| source ---|---|--- 2026-05-12 14:15:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mlnxyuivww2u...

CVE-2025-40949

creationtimestamp| type| source ---|---|--- 2026-05-12 12:19:12+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnrjhsgsn2g 2026-05-14 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-12 2026-07-17 13:07:38+00:00| seen|...