15453 matches found
Exploit for CVE-2026-60137
How does this work at all !plotd...
CVE-2026-47416
CVE-2026-47416 (PraisonAI Platform) : Connected documents describe a vertical privilege-escalation flaw in PATCH /workspaces/{workspace_id}/members/{user_id}. The route uses require_workspace_member with a default min_role of “member”, allowing a Member to set another member’s role to any value (...
Exploit for Code Injection in Craftcms Craft_Cms
CVE-2025-32432 Craft CMS Pre-Auth RCE PoC Critical Pre-Auth...
CVE-2026-15342 CVE-2026-15342
Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned...
CVE-2026-47405 PraisonAI Platform missing role checks let any workspace member become owner and take over workspace membership
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to owner. The issue is caused by privileged...
CVE-2026-47392
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, executecode in praisonaiagents/tools/pythontools.py v1.6.37, subprocess sandbox mode can be fully bypassed using print.self to retrieve the real Python builtins modul...
CVE-2026-47396
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's call server exposes a network-facing agent control API without authentication when CALLSERVERTOKEN is not configured. The affected component is the praisonai.api.agentinvoke router as mounted by praisonai.api.call. The...
SUSE CVE-2026-64205
In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in error path A severe livelock and subsequent Hung Task panic were observed in the i2c-i801 driver during concurrent Fuzzing. The crash is caused by an unconditional hardware...
CVE-2026-64608
Apache Fory: C++ implementation suffers a heap type confusion and out-of-bounds read/write during deserialization in compatible mode. Inconsistent schemas between declared field types and data can trigger memory access issues. Affected: Apache Fory C++ from 0.14.0 up to but not including 1.4.0. R...
Critical ServiceNow AI Platform Flaw Exploited for Unauthenticated Code Execution
Threat actors are now exploiting a recently disclosed critical security flaw impacting ServiceNow AI Platform, according to Defused Cyber. In a post shared on X, the threat intelligence firm said it's observing in-the-wild exploitation of CVE-2026-6875 CVSS score: 9.5, a sandbox escape...
EUVD-2026-46158
The bpost-shipping-platform WordPress plugin before 3.2.3 does not properly sanitize a parameter before using it in a SQL query during WooCommerce order submission, allowing unauthenticated attackers to perform time-based blind SQL injection on stores running this bpost-shipping-platform WordPres...
CVE-2026-14185
The WPBot WordPress plugin prior to 8.2.0 is vulnerable: its retrieval-augmented-generation (RAG) settings handler lacks a capability and nonce check, allowing authenticated users with subscriber-level access to modify the plugin’s configuration. Root cause is missing authorization in the RAG set...
ANT-2026-M8R2AWBV · linux · other
other high Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-M8R2AWBV: ksmbd SMB-Direct: pre-auth remote heap overflow via preferredsendsize signedness mintint Pre-auth remot...
PT-2026-62060
Name of the Vulnerable Software and Affected Versions Data::ReqRep::Shared versions prior to 0.05 Description This issue occurs when the software creates a world-readable mmap backing file and opens it without using O EXCL or O NOFOLLOW. The segment is created in reqrep.h using the open function...
PT-2026-62064
Name of the Vulnerable Software and Affected Versions Data::RoaringBitmap::Shared versions prior to 0.02 Description This issue occurs when creating a world-readable mmap backing file and opening it without the O EXCL or O NOFOLLOW flags. The segment is created using the open function with a mode...
PT-2026-62068
Name of the Vulnerable Software and Affected Versions Data::DisjointSet::Shared versions prior to 0.02 Description This issue occurs when the software creates a world-readable mmap backing file and opens it without using the O EXCL or O NOFOLLOW flags. The segment is created in dsu.h using the op...
PT-2026-62065
Name of the Vulnerable Software and Affected Versions Data::RingBuffer::Shared versions prior to 0.04 Description This issue occurs when a world-readable mmap backing file is created and opened without the O EXCL or O NOFOLLOW flags. The segment is created using the open function with a mode of...
PT-2026-62063
Name of the Vulnerable Software and Affected Versions Data::HashMap::Shared versions prior to 0.14 Description This issue occurs when the software creates a world-readable mmap backing file and opens it without using the O EXCL or O NOFOLLOW flags. The segment is created in shm generic.h using th...
PT-2026-62062
Name of the Vulnerable Software and Affected Versions Data::RadixTree::Shared versions prior to 0.02 Description This issue occurs when a world-readable mmap backing file is created and opened without the O EXCL or O NOFOLLOW flags. The segment is created using the open function with a mode of...