CVE-2026-48786 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

CVE-2026-48786

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

CVE-2026-48786 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

CVE-2026-48786

Fleet , an open-source device management platform built on osquery, has an information disclosure flaw in the target search endpoint (POST /api/latest/fleet/targets). Prior to v4.87.0 , this endpoint failed to mask team enroll secrets and full team configuration (including credential-bearing agen...

EUVD-2026-66657

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

CVE-2026-48786 Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint

Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint POST /api/latest/fleet/targets returned unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-clas...

CVE-2026-19485

CVE-2026-19485 is a Predictable Resource Name (bucket squatting) vulnerability in BigQuery Import Staging within Google Cloud Vertex AI Search for Commerce on Google Cloud Platform, affecting versions prior to 2026-04-27 . An attacker knowing the victim's project number could derive the predictab...

CVE-2026-19485 Bucket Squatting in Vertex AI Search for Commerce

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...

EUVD-2026-66653

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...

CVE-2026-19485 Bucket Squatting in Vertex AI Search for Commerce

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...

DRUPAL-CONTRIB-2026-115

This module enables users to authenticate using LDAP or Active Directory credentials. The module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover additional information they should not normally be able to...

PoCWorkbench

PoCShell PoCWorkbench Desktop-based PoC management and ve...

EUVD-2026-66208

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0...

PT-2026-82373

Name of the Vulnerable Software and Affected Versions Drupal LDAP / Active Directory Integration versions 0.0.0 through 2.2.1 Description An LDAP Injection issue exists because the module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This...

LDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115

This module enables users to authenticate using LDAP or Active Directory credentials. The module does not sufficiently sanitize user-supplied input before incorporating it into an LDAP search filter. This allows an attacker to discover additional information they should not normally be able to...

CVE-2026-19485: Use of Insufficiently Random Values

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce versions prior to 2026-04-27 on Google Cloud Platform allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictab...

Vulnerable Code Search: Transferable Attack for Code Language Models

Reliable code retrieval is crucial for developer productivity and effective code reuse. However, current neural code language models CLMs powering search tools are susceptible to adversarial attacks targeting non-functional textual elements. In this paper, we introduce a programming...

RHEL 9 : sqlite (RHSA-2026:59956)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59956 advisory. SQLite is a C library that implements an SQL database engine. A large subset of SQL92 is supported. A complete database is stored in a sing...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104761)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104761 advisory. Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes...

PT-2026-82370

Name of the Vulnerable Software and Affected Versions Drupal Address Suggestion versions 0.0.0 through 1.0.25 Description Improper neutralization of input during web page generation allows for Cross-Site Scripting XSS. The Address Suggestion module, which provides address autocomplete functionali...