What needs attention now.

SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication

• SEO Flow by LupsOnline
• Privilege escalation

Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log

• wpmudev Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
• Code injection

MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery

• inspireui MStore API – Create Native Android & iOS Apps On The Cloud
• Authentication bypass

OpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation

• Privilege escalation
• Authentication bypass

<1.0.3 || >=1.1.0, <1.1.3 || >=1.2.0-rc.1, <1.2.0 · fixed in 1.0.3, 1.1.3, 1.2.0

IXON VPN Client CRLF Injection

• IXON VPN Client
• Other injection

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers

• Hard-coded credentials

<0.0.0-20260725132049-2d8b98395a91 · fixed in 0.0.0-20260725132049-2d8b98395a91

SiYuan: Embedded (transclusion) block content is returned without publish-access filtering, leaking private and password-protected document content to anonymous readers

• Broken access control

<0.0.0-20260725125659-1ca1c3c9d94b · fixed in 0.0.0-20260725125659-1ca1c3c9d94b

SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

• Hard-coded credentials

<0.0.0-20260725123945-77421530be4a · fixed in 0.0.0-20260725123945-77421530be4a

SiYuan: Publish-access filter on renderAttributeView leaves related-database content unfiltered and fails open on non-block first columns

• Broken access control

<0.0.0-20260724121519-426991d155c0 · fixed in 0.0.0-20260724121519-426991d155c0

Path traversal in SonicWall Network Security Manager (NSM)

• SonicWall Network Security Manager (NSM)
• Path traversal

Missing authorization in SonicWall Network Security Manager (NSM)

• SonicWall Network Security Manager (NSM)
• Broken access control

OS command injection in SonicWall Network Security Manager (NSM)

• SonicWall Network Security Manager (NSM)
• Command injection

CodeWhale: SSRF bypass - TOCTOU on DNS failure for DNS pinning

• Server-side request forgery (SSRF)

>=0.8.41, <0.8.64 · fixed in 0.8.64

Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

• nango
• Authentication bypass

IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed

• IBM Operational Decision Manager
• SQL injection

IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

• IBM Observability with Instana (Agent)
• Broken access control

Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi

• Voltronic Power SNMP Web Pro
• Unrestricted file upload

SadTalker OS Command Injection via Audio Filename

• OpenTalker SadTalker
• Command injection

FastChat Unauthenticated Worker Registration SSRF and Model Spoofing

• lm-sys FastChat
• Authentication bypass

LaVague 0.2.35 Remote Code Execution via eval extraction

• LaVague
• Code injection

TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer

• ten-framework
• Authentication bypass

zerox 1.1.20 OS Command Injection via Document URL File Extension

• getomni-ai zerox
• Command injection

xiaobei through 5.5.2 Unauthenticated Webhook Message Injection

• TeamWiseFlow xiaobei
• Authentication bypass

Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch

• aim
• Authentication bypass

excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode

• haris-musa excel-mcp-server
• Path traversal

cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution

• MladenSU cli-mcp-server
• Command injection

sift 17.1.3 Prototype Pollution Remote Code Execution via $where

• crcn sift.js
• Prototype pollution

Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function

• crystaldba postgres-mcp
• Broken access control

OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker

• openpanel
• Server-side request forgery (SSRF)

Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass

• getgrav grav-plugin-form
• CWE-807

Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth

• traefik
• Authentication bypass

AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes

• AI Website Builder (GitHub build)
• Broken access control

@fastify/middie vulnerable to path-scoped middleware bypass via absolute-form request target

• @fastify/middie
• CWE-436

Apache Allura: Server-side request forgery

• Apache Software Foundation Apache Allura
• Server-side request forgery (SSRF)

Hard-coded password in Xing Inc. XING CPTrans-ME-X

• Xing Inc. XING CPTrans-ME-X
• Hard-coded credentials

XING CPTrans-ME-X contains a Use of Default Password (CWE-1393).

• Xing Inc. XING CPTrans-ME-X
• CWE-1393

OS command injection in Xing Inc. XING CPTrans-ME-X

• Xing Inc. XING CPTrans-ME-X
• Command injection

Canva: The Canva Android App before 2.376.0 allowed an external origin to be loaded in a…

• Canva
• CWE-940

Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter

• Divi Engine Divi Ajax Filter
• File inclusion

Stack-based buffer overflow in FreeIPMI

• FreeIPMI
• Memory corruption

Stack-based buffer overflow in FreeIPMI

• FreeIPMI
• Memory corruption

Stack-based buffer overflow in FreeIPMI

• FreeIPMI
• Memory corruption

Stack-based buffer overflow in FreeIPMI

• FreeIPMI
• Memory corruption

Stack-based buffer overflow in FreeIPMI

• FreeIPMI
• Memory corruption

Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials

• Lightstar SmartIT Desktop Manager
• Hard-coded credentials

Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials

• Lightstar SmartIT Desktop Manager
• Hard-coded credentials

Missing authentication in ASUS Control Center Enterprise (ACC)

• ASUS Control Center Enterprise (ACC)
• Authentication bypass
• Hard-coded credentials

No authentication exists in the MQTT service of Trueview 6.0.23.4.

• Authentication bypass

An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via the Android Debug Bridge (ADB) daemon (adbd)

• Broken access control

PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication.

• Hard-coded credentials

PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port.

• Authentication bypass

PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer

• Authentication bypass

An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component.

• Authentication bypass

An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi.

• Privilege escalation

An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component

• Privilege escalation
• CWE-640

An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php…

• Code injection

easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and ga…

• Unrestricted file upload

In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions.

• Code injection

SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /outaddresspaging path

• SQL injection

Files accessible to external parties in WebPros ConfigServer Security & Firewall and others

• WebPros ConfigServer Security & Firewall
• ConfigServer Security & Firewall
• Information disclosure