CVE-2026-52698

The CVE concerns the WordPress PushEngage plugin (versions

PT-2026-50343

Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget = 4.2.3 versions...

Gitea: Authorization Bypass via "Allow edits from maintainers" allows unauthorized commits to any readable repo

Summary Any authenticated low-privilege user with read access to a repository can push arbitrary commits directly to that repository, bypassing all write-access checks. Vulnerability Gitea's "Allow edits from maintainers" PR option can be abused via reverse-fork PRs: 1. The web UI PR-create...

CVE-2026-48797 Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a training control plane without authentication: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and...

NPM: n8n: Git Node Clone and Push Operations Bypass File Sandbox

NPM: n8n: Git Node Clone and Push Operations Bypass File Sandbox vulnerability discovered by ? in WordPress Npm n8n versions 1.123.48...

GHSA-5XP3-2W67-427V n8n: Git Node Clone and Push Operations Bypass File Sandbox

Impact An authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's Clone operation, or as the target repository in the Push operation, bypassing the N8NRESTRICTFILEACCESSTO file sandbox. This allowed the...

n8n: Git Node Clone and Push Operations Bypass File Sandbox

Impact An authenticated user with permission to create or modify workflows could supply a local filesystem path as the source repository in the Git node's Clone operation, or as the target repository in the Push operation, bypassing the N8NRESTRICTFILEACCESSTO file sandbox. This allowed the...

The vulnerability of the Windows Push Notifications service allows a perpetrator to escalate their privileges.

The vulnerability of Windows push-notifications services is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow attackers to gain increased privileges...

The vulnerability of the Windows Push Notifications service allows a perpetrator to escalate their privileges.

The vulnerability of Windows push-notifications services is related to synchronization errors when using shared resources. Exploiting this vulnerability can allow attackers to gain increased privileges...

The vulnerability of the Windows Push Notifications service allows a perpetrator to escalate their privileges.

The vulnerability of the Windows Push Notifications service is related to the possibility of using memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the Windows Push Notifications service allows a perpetrator to disclose protected information.

The vulnerability of the Microsoft Graphics component in the Windows operating system is related to the disclosure of information. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability of the Windows Push Notifications service allows a perpetrator to escalate their privileges.

The vulnerability of the Windows Push Notifications service is related to the possibility of using memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...

The vulnerability of the Windows Push Notification Service allows a perpetrator to disclose protected information on Windows operating systems.

The vulnerability of the Windows Push Notification Service relates to the use of an uninitialized resource. Exploiting this vulnerability could allow a attacker to disclose sensitive information that is protected by this service...

The vulnerability of the Windows Push Notification Service allows a perpetrator to disclose protected information on Windows operating systems.

The vulnerability of the Windows Push Notification Service relates to the use of an uninitialized resource. Exploiting this vulnerability could allow a attacker to disclose sensitive information that is protected by this service...

The vulnerability of the Windows Push Notifications service allows a perpetrator to disclose protected information.

The vulnerability of Windows Push Notifications services relates to reading data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by these services...

PT-2026-50586

Name of the Vulnerable Software and Affected Versions Gitea versions 1.25.0 and later Description Gitea is subject to stored cross-site scripting XSS through the built-in 3D file viewer, which utilizes the Online3DViewer library. The issue occurs when a .gltf file contains an unsupported extensio...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the orderkey parameter in the Apple MDM commands endpoint. An attacker can extract sensitive values from joined database tables, such as enrollment secrets and APNS tokens, by performing a binary search oracle attack...

Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

Summary A vulnerability in Fleet's Apple MDM commands listing endpoint allowed authenticated users with the lowest-privilege Observer role to extract sensitive values from joined database tables — including host enrollment secrets and Apple Push Notification Service APNS tokens — through a...

GHSA-X4QR-QW6H-WVXQ Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

Summary A vulnerability in Fleet's Apple MDM commands listing endpoint allowed authenticated users with the lowest-privilege Observer role to extract sensitive values from joined database tables — including host enrollment secrets and Apple Push Notification Service APNS tokens — through a...

PT-2026-49057

Name of the Vulnerable Software and Affected Versions Fleet affected versions not specified Description An issue in the Apple MDM commands listing endpoint allows authenticated users with the Observer role to extract sensitive data from joined database tables, such as host enrollment secrets and...