CVE-2026-15054 Bit Form < 3.1.2 - Unauthenticated Inactive Form Submission

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows such as email notifications of forms the site owner has deactivated or...

PT-2026-66392

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows such as email notifications of forms the site owner has deactivated or...

PT-2026-65895

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.7 Description HTTP-emitting modules fetch caller-controlled URLs without using the validate url with env config function, which allows Server-Side Request Forgery SSRF to internal or metadata endpoints. SSRF ...

CVE-2026-57510

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...

CVE-2026-57510 SuperPlane < 0.27.0 Broken Object Level Authorization via CanvasService gRPC

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs...

BIT-ARGO-WORKFLOWS-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...

CVE-2026-48036

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...

CVE-2026-48036 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...

CVE-2026-48036 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...

CVE-2026-48036 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...

CVE-2026-16799

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...

CVE-2026-16799

Devolutions PowerShell Universal versions 2026.2.2 and earlier are vulnerable to improper access control within the automation tests and workflows features. Due to missing server-side authorization checks, an authenticated user with only the Reader role can execute automation tests and modify wor...

EUVD-2026-48606

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...

CVE-2026-16799

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks...

PT-2026-64308

Name of the Vulnerable Software and Affected Versions Devolutions PowerShell Universal versions prior to 2026.2.3 Description Improper access control within the automation tests and workflows features allows an authenticated user assigned the Reader role to execute automation tests and modify...

CVE-2026-16221 vulnerabilities

Vulnerabilities for packages: unleash-fips, wazuh-dashboard, kibana, argo-workflows, renovate, wazuh-dashboard-fips, langfuse-fips, yaml-language-server, gemini-cli, gitlab-rails-ce-fips, gitlab-rails-ce, librechat, prism, keep-fips, arangodb, keep, opensearch-dashboards, unleash,...

GHSA-V2HH-GCRM-F6HX vulnerabilities

Vulnerabilities for packages: unleash-fips, wazuh-dashboard, kibana, argo-workflows, renovate, wazuh-dashboard-fips, langfuse-fips, yaml-language-server, gemini-cli, gitlab-rails-ce-fips, gitlab-rails-ce, librechat, prism, keep-fips, arangodb, keep, opensearch-dashboards, unleash,...

GHSA-V2HH-GCRM-F6HX vulnerabilities

Vulnerabilities for packages: langfuse, vitess, argo-workflows, opensearch-dashboards, renovate, tileserver-gl, yaml-language-server, prism...

CVE-2026-16221 vulnerabilities

Vulnerabilities for packages: langfuse, vitess, argo-workflows, opensearch-dashboards, renovate, tileserver-gl, yaml-language-server, prism...

NPM: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check

NPM: n8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...