WordPress JSON API Auth plugin <= 3.1.2 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Chi Trung Huynh in WordPress Plugin JSON API Auth versions = 3.1.2...

Hardcoded Admin Credentials For Cisco Smart Licensing Utility API

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to log in to an affected system by using a static administrative credential.This vulnerability is due to an undocumented static user credential for an administrative account. An attacker could exploit...

CVE-2026-103097

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103096

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

EUVD-2026-91114

infiniflow ragflow 0.25.3 contains improper access control in resume api/apps/connectorapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

EUVD-2026-91115

Ragflow 0.24.0 and prior contains improper access control in updatemetadatasetting api/apps/kbapp.py. Depending on the exposed entry, an attacker can perform unauthorized cross-session or privilege-crossing operations...

GHSA-QQW9-2VJ9-HX7R Duplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w584-2h2r-2hvf. This link is maintained to preserve external references. Original Description langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The compone...

Duplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w584-2h2r-2hvf. This link is maintained to preserve external references. Original Description langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code remote. The compone...

EUVD-2026-91065

PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret deletecode and uploader metadata by calling the API::info endpoint which returns the complete raw metadata object without a field whitelist. Attackers can use the...

CVE-2026-103097 GV-Eye Relay Payment API Key Vulnerability

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103097

The GV-Eye Relay Payment API is vulnerable to an information disclosure flaw where an API key is hardcoded and retrievable from the application package. Because Android applications can be reverse-engineered, an unauthorized user can extract these sensitive credentials from the client application...

EUVD-2026-91147

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103097 GV-Eye Relay Payment API Key Vulnerability

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

EUVD-2026-91146

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103096 GV-Eye Hardcoded API Key Vulnerability

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103096

The GV-Eye application is vulnerable to a hardcoded API key issue. Because Android applications can be reverse engineered , an attacker can extract sensitive API credentials directly from the application package. This allows unauthorized users to misuse the key for unintended purposes. No specifi...

CVE-2026-103096 GV-Eye Hardcoded API Key Vulnerability

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-104467: Missing Authorization

YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/updateconfig and api/archives to overwrite...

CVE-2026-97219: Missing Authorization

The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods without paying...

CVE-2026-103956: Missing Authentication for Critical Function

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...