CVE ID :CVE-2026-111823 Published : Oct. 16, 2026, 11:16 p.m. | 17 minutes ago Description :Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. Severity:…
CVE-2026-96627 – Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
CVE ID :CVE-2026-96627 Published : Oct. 16, 2026, 10:18 p.m. | 1 hour, 15 minutes ago Description :Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in…
CVE-2026-96626 – Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host
CVE ID :CVE-2026-96626 Published : Oct. 16, 2026, 10:18 p.m. | 1 hour, 15 minutes ago Description :Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and…
CVE-2026-49410 – OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation
CVE ID :CVE-2026-49410 Published : Oct. 16, 2026, 10:17 p.m. | 1 hour, 17 minutes ago Description :OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0…
CVE-2026-96620 – Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
CVE ID :CVE-2026-96620 Published : Oct. 16, 2026, 8:18 p.m. | 3 hours, 15 minutes ago Description :Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is…
CVE-2026-75941 – Lenovo Legion Zone Remote Code Execution Vulnerability
CVE ID :CVE-2026-75941 Published : Oct. 15, 2026, 11:17 p.m. | 16 minutes ago Description :A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that…
CVE-2026-111366 – cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints
CVE ID :CVE-2026-111366 Published : Oct. 15, 2026, 10:19 p.m. | 1 hour, 14 minutes ago Description :cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their…
CVE-2026-111356 – MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force
CVE ID :CVE-2026-111356 Published : Oct. 15, 2026, 10:19 p.m. | 1 hour, 14 minutes ago Description :MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers…
CVE-2026-111352 – ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API
CVE ID :CVE-2026-111352 Published : Oct. 15, 2026, 10:19 p.m. | 1 hour, 14 minutes ago Description :ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call…
CVE-2026-111347 – go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd
CVE ID :CVE-2026-111347 Published : Oct. 15, 2026, 10:19 p.m. | 1 hour, 14 minutes ago Description :go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted…