Metabase 0.63.4 SQL Injection

A proof of concept exploit for an unauthenticated SQL injection vulnerability in Metabase version 0.63.4. The vulnerability allows an attacker-controlled user-id value supplied to the password reset endpoint to reach a HoneySQL query as raw SQL. On installations using the default embedded H2...

PT-2026-70914

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

PT-2026-70179

An authenticated attacker can spoof another GUI user's identity by sending their request with the custom header "Grpc-Metadata-USER". This can lead to an account takeover attack from a user with low privileges to administrator...

PT-2026-70174

n8n before 2.32.1 and before 2.31.5 is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's...

PT-2026-70798

Name of the Vulnerable Software and Affected Versions PeerTube versions prior to 8.1.6 Description An issue exists in the ActivityPub-federated video streaming platform where the updateScore function in ActorFollowModel interpolates the attacker-controlled ActivityPub actor inboxUrl into an SQL...

PT-2026-70235

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email verified" claim and do not actually verify the email. This allows a user to...

CVE-2026-51584

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...

PT-2026-70209

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth service.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject...

PT-2026-70816

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

PT-2026-70264

CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference IDOR that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action...

CVE-2026-72917

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-72917 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-72917

AnythingLLM up to version 1.15.0 has an account-recovery weakness in the unauthenticated recovery flow (server/utils/PasswordRecovery/index.js). The code uses recoverAccount() to deduplicate recoveryCodes before trimming, allowing a valid code submitted twice with different surrounding whitespace...

CVE-2026-72917

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

CVE-2026-72917 AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1.15.0, AnythingLLM's unauthenticated account-recovery flow in server/utils/PasswordRecovery/index.js uses recoverAccount to deduplicate the raw recoveryCodes...

GHSA-P9J2-GV94-2WF4

creationtimestamp| type| source ---|---|--- 2026-08-10 19:39:37+00:00| seen| https://gist.github.com/klemmanton-lgtm/8b54bdd2fe9905dc89b9c8ccf42f5fc4 2026-08-10 19:39:38+00:00| seen| https://gist.github.com/klemmanton-lgtm/4a24aedae8017b5aebed0300d07c7ee9 2026-08-17 10:21:36+00:00| seen|...

CVE-2026-72871

Dokploy (PaaS) vulnerability CVE-2026-72871: Before version 0.29.13, the unauthenticated /api/providers/github/setup route in Dokploy trusts gh_init organizationId and userId from the state and calls createGithub, enabling an attacker to insert a GitHub App provider containing client_secret, webh...

CVE-2026-72871

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the unauthenticated /api/providers/github/setup route in apps/dokploy/pages/api/providers/github/setup.ts trusts ghinit organizationId and userId values from the state parameter and calls createGithub in...

WordPress Cartify theme <= 1.3.0.1 - Account Takeover vulnerability

Account Takeover vulnerability discovered by Denver Jackson in WordPress Theme Cartify versions = 1.3.0.1...

CVE-2026-18469

The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will...