CVE-2026-105129

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

CVE-2026-105129

LaraDashboard versions prior to 1.4.8 are vulnerable to an incorrect authorization flaw (CWE-863) in the settings API. Authenticated users possessing only the settings.view permission can perform GET requests to /api/settings or /api/settings/{option_name} to access sensitive data. This vulnerabi...

PT-2026-95273

Name of the Vulnerable Software and Affected Versions GPTranslate – Multilingual AI Translation Agent for WordPress versions prior to 2.34.7 Description Sensitive information exposure occurs via the enqueue frontend scripts function. Unauthenticated attackers can extract plaintext third-party AI...

CVE-2026-74799: Insertion of Sensitive Information Into Debugging Code

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider...