CVE-2026-92360

A medium-severity vulnerability (CVSS 3.1: 6.3 ) exists in ag-ui-protocol ag-ui 1.0 , specifically in the Event Application Layer component. The vulnerable element is the prepareRunAgentInput function in agent/agent.ts , where manipulation of the TEXT_MESSAGE_START argument triggers an origin val...

CVE-2026-88817

Curiosity Workspace is affected by a privilege escalation vulnerability in its legacy access group creation endpoint . An authenticated, non-guest user could enroll themselves as an administrator and member of an existing access group without an invitation or approval. However, the flaw did not g...

CVE-2026-92359

CVE-2026-92359 affects ag-ui-protocol ag-ui 0.3.0 , specifically the CORSMiddleware component in the create_strands_app function within integrations/aws-strands/python/src/ag_ui_strands/utils.py. The root cause is a permissive cross-domain policy that allows untrusted domains, potentially enablin...

CVE-2026-92465

Themeum WP Mega Menu (WordPress plugin) is vulnerable to Blind SQL Injection through improper neutralization of special elements in SQL commands. The issue affects versions up to and including 1.4.2 . The vulnerability is rated CVSS 3.1 7.6 (HIGH) with a vector of AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/...

CVE-2026-58147

The WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. The application fails to properly neutralize special elements in the http_passwd_hidden and http_passwdConfirm_hidden parameters, allowing an authenticate...

CVE-2026-58146

The WNC T-Mobile 5G Box IDU router is affected by an OS command injection vulnerability in the /cgi-bin/portal.cgi endpoint. The cli_cookie POST parameter is concatenated directly into a find command string without sanitization, allowing a remote, unauthenticated attacker on the adjacent network ...

CVE-2026-40857

WNC T-Mobile 5G Box IDU routers contain a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechanism fails to validate the csrf_token_value parameter, accepting any arbitrary value as valid. This allows a remote attacker to perform unauthorized actions on...

CVE-2026-40856

WNC T-Mobile 5G Box IDU routers are affected by an improper access control vulnerability in the wnc_maccheck.cgi endpoint, which is accessible without authentication . A remote attacker can retrieve sensitive configuration data, including the administrator web password , WiFi passphrase , and tec...

CVE-2026-40855

WNC T-Mobile 5G Box IDU router is vulnerable to a command injection in the ping functionality served by the /cgi-bin/portal.cgi endpoint. The unsanitized POST parameters ping_ip , ping_size , and ping_times are passed directly into a system command, allowing an authenticated attacker to execute a...

CVE-2026-40854

CVE-2026-40854 affects the WNC T-Mobile 5G Box IDU router . The vulnerability resides in the portal.cgi component, where the session verification mechanism validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/login_user . Because this check does not properl...

CVE-2026-92463

yshop-crm through 2.1.3 has an authorization bypass in the GET /admin-api/system/user/page endpoint, where the @PreAuthorize annotation is commented out. This allows any authenticated back-office user—without the system:user:list permission—to enumerate the complete user directory, including logi...

CVE-2026-92462

yshop-crm through version 2.1.3 is vulnerable to a missing authorization flaw in the CrmFlowController deleteFlowStep endpoint (DELETE /admin-api/crm/flow/delete-step). Any authenticated back-office user can invoke this endpoint without the required permissions to delete arbitrary approval workfl...

CVE-2026-92461

yshop-crm through 2.1.3 is affected by a missing authorization flaw in the GET /admin-api/crm/flow/flow-users endpoint. Any authenticated back-office user can retrieve approval workflow data, including approval chain topology , step ordering , and approver identifiers , as well as personal inform...

CVE-2026-92460

CVE-2026-92460 affects yshop-crm through 2.1.3 , a CRM application. The vulnerability is a missing authorization check on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide operation log without proper permission checks. Ex...

CVE-2026-92458

yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler. The endpoint GET /admin-api/product/store-product/sale lacks proper permission checks, allowing authenticated back-office users to iterate sequential product IDs to withdraw entire...

CVE-2026-92459

yshop-crm through 2.1.3 is affected by a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint. Authenticated back-office users can invoke the lead-claim endpoint to reassign sales leads from other employees to themselves by overwriting the ownerUserId field. No a...

CVE-2026-92457

yshop-crm through version 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint (PUT /admin-api/crm/invoice/issue). Authenticated back-office users can call this endpoint without the required permission check, allowing them to issue arbitrary invoi...

CVE-2026-92456

yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController , allowing any authenticated back-office user to read and modify installation-wide lead-allocation and customer auto-recycling policy stored in shared Redis keys. An attac...

CVE-2026-92455

CVE-2026-92455 affects yshop-crm through 2.1.3 , where the sendSms and sendMail endpoints in CrmCustomerController lack proper authorization enforcement. This allows any authenticated back-office user to invoke POST /admin-api/crm/customer/send-sms and POST /admin-api/crm/customer/send-mail with ...

CVE-2026-92357

a2ui-project a2ui versions 0.8, 0.9, and 1.0 contain an information disclosure vulnerability in the Model Processor component (file model-processor.ts). The root cause is manipulation of the argument current[segment], which can be triggered remotely by a low-privileged user with no user interacti...