Published threat advisories for July 10, 2026

A security flaw in charging station technology allows unauthorized users to connect to a websocket endpoint without authentication, potentially leading to privilege escalation. This issue could enable an attacker to gain elevated access and control over the charging station system when the endpoint is reachable.

NVD modified: NVD date unavailable

A critical vulnerability in Drupal Commerce guest registration may allow unauthenticated attackers to bypass authentication, potentially leading to unauthorized access to data. This issue affects public-facing commerce functions and warrants confirmation of relevance and exposure.

NVD modified: NVD date unavailable

A critical vulnerability exists in the Drupal Mother May I module that could allow unauthorized access and potential system compromise. The issue, rated as critical, could be exploited by unauthenticated remote attackers via network requests, potentially leading to unauthorized information exposure or code execution. G

NVD modified: NVD date unavailable

A vulnerability exists in Tilt's HUD HTTP server that allows unauthenticated network access to developer-defined resources, Tiltfile arguments, and sensitive session state when the HUD is bound to a non-loopback address. This could enable an attacker to trigger developer actions or interact with Kubernetes resources vi

NVD modified: NVD date unavailable

A vulnerability in the Drupal Plotly.js Graphing module allows for object injection, potentially impacting data integrity and system availability. Attackers could exploit this by sending malicious requests, leading to unauthorized modification of system data. Confirming the use and exposure of this module is advised.

NVD modified: NVD date unavailable

A vulnerability exists in the Drupal Flag attendance field, allowing object injection due to improper control over dynamically determined object attributes. This critical vulnerability, if reachable, could enable unauthorized data modification and potentially lead to system compromise. Organizations should confirm if t

NVD modified: NVD date unavailable

A critical Cross-Site Request Forgery vulnerability in the Drupal Salesforce Suite could permit attackers to trick users into performing unintended actions. This may lead to unauthorized changes to data or system behavior if the module is reachable. The relevance and exposure of this vulnerability need to be confirmed.

NVD modified: NVD date unavailable

A critical vulnerability exists in the Drupal Paragraphs module due to missing authorization, potentially allowing forceful browsing. This could enable unauthorized access to sensitive information or content. The issue is network-reachable and requires no authentication to exploit.

NVD modified: NVD date unavailable

A critical vulnerability exists in the Drupal Paragraphs module, allowing forceful browsing due to missing authorization. This could enable unauthenticated attackers to access or modify content on affected Drupal websites. Confirmation of relevance and exposure is critical for leadership.

NVD modified: NVD date unavailable

A critical authorization vulnerability in the Drupal WissKI module allows forceful browsing, potentially enabling unauthenticated users to access restricted information or functionalities. This could lead to unauthorized access to sensitive data, impacting confidentiality, integrity, and availability. Further analysis

NVD modified: NVD date unavailable

An authorization vulnerability in the Drupal Commerce Realex / Global Payments module allows forceful browsing, potentially enabling unauthorized access to sensitive payment processing functions or data. This issue affects organizations using the module for e-commerce transactions, posing a risk to financial data integ

NVD modified: NVD date unavailable

An incorrect authorization vulnerability in Drupal AI Agents may allow forceful browsing. This could lead to unauthorized access to AI agent functions and potentially sensitive information. The key concern is confirming the use and reachability of this technology to assess potential exposure.

NVD modified: NVD date unavailable

A critical vulnerability exists in Drupal AI Agents due to missing authorization, allowing forceful browsing. This could lead to unauthorized access and modification of sensitive data or system configurations if the AI agents are reachable.

NVD modified: NVD date unavailable

A critical vulnerability exists in a Drupal AI module that allows forceful browsing due to missing authorization. This could permit unauthorized users to access restricted AI model data or functionality via network access. Organizations using the affected Drupal AI module should identify its instances, determine exposu

NVD modified: NVD date unavailable

A Server-Side Request Forgery vulnerability exists in a Drupal module that integrates with OpenAI. This flaw could allow an attacker to trick the server into making unintended requests to internal or external resources. This could potentially lead to unauthorized access to sensitive data or systems. The relevance and e

NVD modified: NVD date unavailable

An authorization flaw in the Drupal Advanced Content Feedback module allows forceful browsing. This could enable unauthenticated attackers to bypass access controls and view sensitive content or perform unauthorized actions on a Drupal site. It is uncertain if this module is in use or exposed within the organization's

NVD modified: NVD date unavailable

A critical vulnerability in the Drupal Formatter Field module allows for object injection, potentially enabling attackers to execute arbitrary code. This issue is reachable via the public web interface and could lead to full system compromise, affecting the website and its underlying server. It is uncertain which speci

NVD modified: NVD date unavailable

A missing authorization vulnerability in Drupal Examples for Developers may allow forceful browsing if the module is reachable. This could lead to unauthorized access to information and system functions. Its intended use is for development and education, so its presence in production environments should be confirmed an

NVD modified: NVD date unavailable

A missing authorization flaw in Drupal LocalGov Workflows enables forceful browsing, potentially allowing unauthenticated attackers to access restricted content or functionality. This could lead to unauthorized data exposure or unintended system actions, impacting organizations using the affected module. Confirmation o

NVD modified: NVD date unavailable

A critical vulnerability exists in the Drupal AlternativeCommerce (Basket) module, allowing object injection. If reachable, this could lead to unauthorized modification of objects, impacting system integrity and availability. It's important to determine if this module is in use to understand potential exposure.

NVD modified: NVD date unavailable

An authentication bypass vulnerability exists in miniOrange's OAuth Single Sign-On client, allowing for password recovery exploitation. This could enable unauthorized access to user accounts when the client is exposed. The issue affects the authentication process, highlighting the need to confirm relevance and exposure

NVD modified: NVD date unavailable

RabbitMQ brokers contain an authentication bypass vulnerability. An attacker may remotely connect to the broker by exploiting a loopback check flaw when traffic is routed through a trusted PROXY-protocol path. This could allow unauthorized access to the messaging system.

NVD modified: NVD date unavailable

A vulnerability in the RabbitMQ management plugin allows attackers to trigger outbound DNS and SMB requests to attacker-controlled UNC paths by sending specially crafted web requests. This could potentially lead to information disclosure or system compromise if the management plugin is exposed and multiple management e

NVD modified: NVD date unavailable

OpenReplay, a self-hosted session replay tool, has a vulnerability where unauthenticated attackers can inject scripts into the dashboard, enabling them to steal session JWTs and take over accounts. This happens when custom event data is not properly output encoded before being rendered.

NVD modified: NVD date unavailable

A critical vulnerability exists in a WordPress social login plugin that could allow unauthenticated attackers to bypass authentication and take over administrator accounts. The flaw involves improper handling of email verification and one-time passwords, enabling an attacker to trigger an OTP, crack it offline, and gai

NVD modified: NVD date unavailable

An argument injection vulnerability exists in MCP Server Kubernetes that can allow an unauthenticated attacker to redirect commands to a malicious server. This could lead to the exposure of authentication tokens and a full compromise of the Kubernetes cluster. Uncertainty remains regarding the specific versions affecte

NVD modified: NVD date unavailable

A critical SQL injection vulnerability in SEM-PMP may allow attackers to execute arbitrary commands remotely. This could lead to unauthorized control and compromise of affected systems. It is important to determine if your organization uses SEM-PMP and to assess its network exposure.

NVD modified: NVD date unavailable

A vulnerability in Prowler's SAML authentication could allow an authenticated attacker to gain unauthorized access to different tenants within the platform. This manipulation of the SAML flow could lead to cross-tenant account takeover, exposing sensitive cloud security data and configurations.

NVD modified: NVD date unavailable

An SQL injection vulnerability exists in MobilMen 20T, a retail automation software, allowing attackers to manipulate or access data. The vendor has not responded to disclosures of this critical issue, making it important to identify any deployed instances and assess their relevance.

NVD modified: NVD date unavailable

A vulnerability exists in the Grav CMS database plugin, allowing for arbitrary SQL execution by crafting specific table names. This could lead to unauthorized database access or manipulation if the plugin is in use and reachable.

NVD modified: NVD date unavailable

A vulnerability in Invixium IXM WEB allows an unauthenticated attacker to escalate privileges via user creation components. This could grant unauthorized control over the system's user management, potentially impacting data confidentiality and integrity if the web interface is network-accessible.

NVD modified: NVD date unavailable

A critical vulnerability in the 9Router AI router allows unauthenticated users to export or import the entire database, potentially exposing sensitive credentials and tokens. This impacts versions prior to 0.4.80.

NVD modified: NVD date unavailable

A flaw in guardrails-detectors allows remote attackers to provide a malicious XML Schema Definition, enabling server-side requests to arbitrary URLs or local file reads. This could expose sensitive information such as cloud credentials or internal network services.

NVD modified: NVD date unavailable

A critical code injection vulnerability exists in PraisonAI technology, allowing an authenticated attacker to execute arbitrary Python code. This occurs when an unsanitized parameter is directly interpolated into an f-string, leading to the execution of injected code via subprocess.Popen(). This could impact system int

NVD modified: NVD date unavailable

A path traversal vulnerability exists in IntelliJ IDEA, allowing for code execution if a user opens a specially crafted project. This flaw impacts a core developer tool, potentially affecting the integrity and confidentiality of local project data and developer workstations.

NVD modified: NVD date unavailable

Vikunja has an authorization flaw that could allow an unauthenticated attacker to escalate privileges and access or delete all file attachments across an entire instance. This vulnerability is reachable via network endpoints without authentication, posing a risk of instance-wide data exposure.

NVD modified: NVD date unavailable

A server-side request forgery vulnerability exists in Crawl4AI's Docker API server. This flaw allows an attacker to trick the server into making requests to internal or external resources, potentially exposing sensitive cloud metadata or internal services. The issue stems from the server accepting webhook URLs without

NVD modified: NVD date unavailable

Dell PowerFlex Manager contains an OS command injection vulnerability that a highly privileged attacker with remote access could exploit. Successful exploitation may allow arbitrary command execution as root, potentially leading to full appliance compromise and lateral movement within the managed infrastructure. Uncert

NVD modified: NVD date unavailable

R-SOFT DMS's OCR module has an OS command injection vulnerability, potentially allowing an authenticated attacker to run commands as root. While some standard flows neutralize this, triggering the OCR module directly can bypass protections. Readers should care because unauthorized root-level access could grant an attac

NVD modified: NVD date unavailable

A flaw in the `guardrails-detectors` component allows remote attackers to perform a blind Server-Side Request Forgery by submitting a crafted XML Schema Definition. This could lead to unauthorized access to sensitive internal network resources and local files, potentially exposing credentials and secrets.

NVD modified: NVD date unavailable

A path traversal vulnerability exists in Apache IoTDB that could allow an attacker to write arbitrary files to locations with write permissions. This could impact data integrity and system stability if the vulnerable API is reachable.

NVD modified: NVD date unavailable

A critical authentication bypass vulnerability exists in Apache IoTDB's REST API, allowing attackers to use stale credentials to gain unauthorized access. This could expose sensitive data and system control. The issue is network-exploitable and should be addressed promptly.

NVD modified: NVD date unavailable

A SQL injection vulnerability exists in the GEO my WP WordPress plugin due to improper handling of location search parameters. This could allow an unauthenticated attacker to manipulate database queries, potentially leading to unexpected behavior and data corruption. Confirmation of plugin usage and exposure is necessa

NVD modified: NVD date unavailable

The Instant Appointment plugin for WordPress has a critical vulnerability that allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution. This issue is reachable via network access without user interaction, posing a significant risk to website integrity and availability.

NVD modified: NVD date unavailable

A critical vulnerability in the Super Forms WordPress plugin allows unauthenticated attackers to upload and execute arbitrary files, potentially leading to remote code execution. This is possible through two unauthenticated HTTP requests due to missing file type validation and bypassed session nonce checks. Readers sho

NVD modified: NVD date unavailable

A vulnerability in the Langroid framework's Neo4jChatAgent allows prompt injection to bypass validation, potentially leading to unauthorized access or destruction of graph data and system-level compromise. This issue stems from LLM-generated Cypher queries being passed directly to the Neo4j driver without proper checks

NVD modified: NVD date unavailable

The Langroid framework contains a critical vulnerability in its `TableChatAgent` and `VectorStore` capabilities that allows for remote code execution. Incomplete sanitization during the evaluation of LLM-generated tool messages can enable an attacker to bypass security measures and execute arbitrary code on the host sy

NVD modified: NVD date unavailable

A critical vulnerability exists in the Langroid framework's `SQLChatAgent`, allowing attackers to bypass SQL injection defenses and read server-side files. This issue, present before version 0.65.1, could lead to sensitive data exposure if the framework is used in LLM-powered applications that are exposed to external i

NVD modified: NVD date unavailable