Analysis

CVE-2026-44087 is an insufficient verification of data authenticity issue (CWE-345) in the openid-connect plugin of Apache APISIX under default configuration. According to the record, an attacker can spoof identity headers and gain unauthorized access to protected resources. The description states that versions from 2.3 through 3.16.0 are affected and recommends upgrading to 3.17.0.

CVE-2026-12249 affects Canonical ADSys upstream versions through v0.16.2. During AD CS certificate auto-enrollment, the component requests the CA certificate over plaintext HTTP, which allows a network attacker in a man-in-the-middle position to inject a rogue root CA into the system trust store. The record states the issue is resolved in v0.16.3.

CVE-2026-56141 affects JetBrains Hub builds in several release branches, where predictable restore codes could allow account takeover. The CNA scores it as critical (CVSS v3.1 base score 9.8), and the record lists fixed boundaries for each branch. No confirmed exploitation appears in the sources consulted.

CVE-2026-5366 affects Prefect version 3.6.23 and is described as allowing remote code execution through unvalidated input in the GitRepository storage class. The record reports that user-controlled values reach git commands without a separator, allowing git flags to be injected. The CNA rates it critical with a CVSS 3.0 score of 9.9, and no confirmed exploitation appears in the sources consulted.

A Cross-Site Request Forgery flaw in the cas-auth plugin of Apache APISIX under default configurations may let a remote attacker lead a victim's browser into an authenticated state tied to a different identity. The record reports a CVSS 3.1 base score of 9.3 from NVD and a fix in version 3.17.0. The sources consulted show no KEV listing and no confirmed exploitation.

Langflow versions before 1.9.1 let unauthenticated users upload unlimited data, which can exhaust server storage. The response also reveals the absolute path of uploaded files, an information leak that can help an attacker chain other weaknesses. The fix is available in 1.9.1, and no confirmed exploitation appears in the sources consulted.

centraldogma-server versions prior to 0.84.0 fall back to a hard-coded, publicly known secret when ZooKeeper replication is enabled without replication.secret. The record states that an attacker with network access could read the replication log or join the quorum to run replicated commands. The CNA rates this critical with a CVSS 4.0 base score of 9.4, and the record shows no KEV listing.

FOSSBilling versions from 0.5.4 up to but not including 0.8.0 contain an authorization bypass in API role handling that lets unauthenticated requests reach privileged /api/system/ endpoints. The GitHub CNA assigns a CVSS 4.0 base score of 10, and the record states that version 0.8.0 patches the issue. No confirmed exploitation appears in the sources consulted, and the record shows the CVE is not listed in CISA KEV.

Cap-go before 12.128.2 contains an authentication logic flaw in which an attacker can register an account tied to a victim's email address before that address is verified. By enabling two-factor authentication on the pre-registered account, the attacker can take control of it and lock out the legitimate owner. The record reports a CVSS 3.1 base score of 9.1 and a CVSS 4.0 score of 9.3 from VulnCheck, and CISA KEV does not list it.

An SQL injection vulnerability (CWE-89) in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin for WordPress affects versions up to and including 1.5.3. Patchstack scored it 9.3 under CVSS 3.1, and the record lists no fixed version. No confirmed exploitation appears in the sources consulted.

A vulnerability in yt-dlp before 2026.06.09 lets a remote attacker write OS-shortcut files such as .desktop, .url and .webloc to the user's filesystem. It bypasses the earlier fix for CVE-2024-38519 because the allowlist explicitly permitted these extensions. Upgrading to 2026.06.09 or later is the documented remediation.

libcurl versions 7.1 through 7.57.0 can send custom headers, including Authorization headers, to hosts other than the original one when following HTTP 30X redirects. This can expose authentication data to third parties. NVD scores it CVSS 3.1 9.8 (critical), and the record does not list it in CISA KEV.

Crawl4AI versions before 0.8.7 ship a hardcoded default JWT signing key in their Docker API server. Anyone who knows that key can forge tokens for any user and bypass authentication. The record rates it critical (CVSS 3.1 score 9.8), and no confirmed exploitation appears in the sources consulted.

CVE-2026-39999 is an authentication bypass by spoofing (CWE-290) in Apache APISIX, linked to certain configurations of the jwt-auth plugin. The record states that the issue affects versions from 2.2 through 3.16.0 and is fixed in 3.17.0. NVD rates it 9.1 under CVSS 3.1, and the record shows no CISA KEV listing.

The SignUp & SignIn plugin for WordPress, in versions up to and including 1.0.0, performs a weak check during password reset that can be abused without logging in. According to the record, an unauthenticated attacker could change the password of any user, including administrators, and take over the account. The record reports no KEV listing and no confirmed exploitation in the sources consulted, and it provides no fixed version.