CVE-2026-55532: Origin Validation Error

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, MCP HTTP Stream validateorigin uses requestorigin.startswithallowed, allowing the attacker-controlled localhost.attacker.com HTTP origin to satisfy the localhost allowlist. A webpage can send Content-Type: text/plain requests...

PT-2026-81906

Kimai before 2.62.0 fails to validate create other timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view other timesheet and edit other timesheet permissions can create timesheet records for team members by submitting the QuickEntry form,...

PT-2026-81458

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user...

CVE-2026-79151: Improper Input Validation

Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file. Chromium security severity: Medium...

CVE-2026-18261: Improper Input Validation

Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions:...

CVE-2026-63073: Use of Externally-Controlled Format String

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

CVE-2026-63073

Issue summary: OpenSSL CMP response validation passed an unexpected response sender distinguished name directly as the format string to ERRraisedata. Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client that enforces an expected sender or uses a pinned server certificate...

PT-2026-81326

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description The Jobs API contains a flaw where the validate webhook url function fails open when a socket.gaierror occurs during DNS resolution. This allows the webhook url parameter to bypass validation if t...

PT-2026-81426

Webkul QloApps does not validate request parameters before a database query. A remote, authenticated attacker with administrative privileges could send a crafted SQL query to the 'bo query' parameter in the 'Address.php' file. Fixed in 123c97c...

PT-2026-81187

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which...

PT-2026-81451

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require use...

PT-2026-81606

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description Improper input validation in the GPU component allows a remote attacker who has compromised the renderer process to potentially execute arbitrary code outside the sandbox. Th...

PT-2026-81126

Adminer before 5.5.0 contains a server-side request forgery vulnerability in the login form's server field validator, which only inspects leading integers for privileged ports and fails to reject non-numeric port values. Attackers can inject PDO DSN keys like host= and port= into the server...

CVE-2026-56708: Time-of-check Time-of-use (TOCTOU) Race Condition

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresse...

PT-2026-81281

Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect internal/service/auth/auth.go that compares only the scheme and host of the client-supplied redirect uri against the admin-configured allowlist, ignoring path, query, and fragment...

PT-2026-81890

Name of the Vulnerable Software and Affected Versions Doorkeeper OpenID Connect versions prior to 1.10.4 Description The Dynamic Client Registration DCR endpoint persists client-supplied scopes without validating them against the server's configured scope set. In the...

CVE-2026-34959: Improper Input Validation

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER"REQUESTURI" with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL e.g. X-Forwarded-Prefix: https://evil.example that flows into Location redirect header...

PT-2026-81774

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in the Preload component allows a remote attacker who has compromised the renderer process to bypass the web origin policy through a crafted HTML page. The web...

PT-2026-81813

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in the Network component allows a remote attacker to leak sensitive information. This is achieved by leveraging social engineering to entice a user to visit a...

PT-2026-81583

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in the StorageAccessAPI allows a remote attacker who has compromised the renderer process to bypass the web origin policy through a crafted HTML page. The web...