CVE-2026-63160

Omnispace Agora Project < 26.10.0 Insecure Remember-Me Token Storage

Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value identical to the bearer credential held in the user's cookie. Attackers who gain access to the stored token, such as through database or backup disclosure, can replay the plaintext value to authenticate as the victim user without needing their password.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63159

Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover

Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63158

Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies

Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism treating the stored hash as a directly replayable bearer credential. Attackers can set the AGORAP_LOG/AGORAP_PASS cookies with a stolen password hash to impersonate any user, including administrators, and gain unauthorized access to the application.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63157

Omnispace Agora Project < 26.10.0 Stored XSS via Links Module

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address (adress) field that is echoed into an onclick event-handler attribute without neutralizing quotes. Attackers can store a crafted payload through the Links module that executes in the browser of any user viewing the links list, enabling session hijacking or further client-side compromise.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63156

Omnispace Agora Project < 26.10.0 Reflected XSS via visioUrl Parameter

Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was urldecoded after filtering. Attackers can craft a malicious URL containing the visioUrl parameter with an attribute breakout payload to execute arbitrary JavaScript in the victim's browser pre-authentication, with the issue fixed in version 26.10.0 via changes to app/Common/Req.php.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63154

Omnispace Agora Project < 26.10.0 SQL Identifier Injection via agoraFields[]

Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-controlled agoraFields[] names as unvalidated SQL column identifiers during the user import flow. Attackers can inject privileged column names such as generalAdmin or use backtick-injection techniques to set administrative flags and escalate to general administrator privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63153

Omnispace Agora Project < 26.10.0 Broken Access Control via setAffectations()

Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63152

Omnispace Agora Project < 26.10.0 Second-Order SQL Injection via _idCategoryFilter

Omnispace Agora Project before 26.10.0 contains a second-order SQL injection vulnerability that allows authenticated attackers to inject malicious SQL via the _idCategoryFilter parameter, which is persisted into the session and later concatenated into a SQL statement without parameterization. Attackers can store a malicious payload that executes when the filter is subsequently applied in app/Common/MdlCategory.php, leading to unauthorized database access or manipulation.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63149

Omnispace Agora Project < 26.10.0 Predictable Default Password via uniqid()

Omnispace Agora Project before 26.10.0 contains an insecure randomness vulnerability that allows attackers to predict temporary or default account passwords generated by Txt::defaultPassword() using PHP's uniqid() function based on server time in microseconds. Attackers who observe or approximate the account creation time can compute the predictable password and take over the account before the legitimate user logs in.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63148

Omnispace Agora Project < 26.10.0 Stored XSS via Poll-Response Attachment Filename

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63147

Omnispace Agora Project < 26.10.0 Stored XSS via Uploaded File Name

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $_FILES rather than $_GET/$_POST. Attackers can upload a file with a crafted name such as an SVG onload payload to have the unsanitized filename stored and later rendered to other users, resulting in script execution in their browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63146

Omnispace Agora Project < 26.10.0 PHP Code Injection via config.inc.php

Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through File::updateConfigFile() and DbInstall::dbControl(), combined with an SQL injection issue enabled by PDO::ATTR_EMULATE_PREPARES supporting stacked queries. Attackers can exploit the SQL injection to re-trigger the installer and inject arbitrary PHP code into config.inc.php, achieving unauthenticated remote code execution on the underlying system.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-56101

OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openbsd

CVE-2026-115727

AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server

AgenticSeek before commit 409840c contains a remote code execution vulnerability because llm_server/app.py hardcodes Flask debug mode while binding to all interfaces. Attackers who reach the server port and obtain the derivable Werkzeug debugger PIN can execute Python code and operating system commands with llm_server privileges.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Fosowl

Products

Agenticseek

CVE-2026-112342

Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning

Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions across multiple permission classes and views.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Tandoor

Products

Recipes

CVE-2026-112329

Sensei LMS 4.26.4 Broken Access Control via save_new_message

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic Wordpress-extensions

Products

Sensei Lms Sensei Lms

CVE-2026-112328

Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automattic Wordpress-extensions

Products

Sensei Lms Sensei Lms

CVE-2026-112296

FlyCms through commit edfdf724 Default Super Administrator Credentials

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super administrator access via the flycms account with password admin123. Attackers can log in through POST /api/auth/login, solving only the image captcha, to obtain full control of site content, users and configuration.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Flycms Project Sunkaifei

Products

Flycms Flycms

CVE-2026-112295

FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update

FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account columns by submitting extra User bean fields to /ucenter/account_update. Attackers can change their review status, rename themselves, or duplicate another account's username, email or mobile to break that victim's login.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Flycms Project Sunkaifei

Products

Flycms Flycms

CVE-2026-112294

FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests to /ucenter/action/{modelCode}/{id}/counter or /ucenter/action/compose to add arbitrary deltas to numeric fields like price, stock, or points.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Flycms Project Sunkaifei

Products

Flycms Flycms