65 matches found
CVE-2026-127063
The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to...
EUVD-2026-124597
The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to...
CVE-2026-127063
The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to...
CVE-2026-127063
The third-party RMM+ extension for ConnectWise ScreenConnect is vulnerable to unauthorized access due to the use of a static API secret by default (CWE-1392 ). If the default value is retained, attackers may access extension API functionality, including the ability to send commands to managed age...
PT-2026-145909
Name of the Vulnerable Software and Affected Versions DataComm RMM+ extension for ConnectWise ScreenConnect affected versions not specified Description The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. If an administrator does not change this value,...
CVE-2026-101050
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...
CVE-2026-101050 Heym before 0.0.53 Authentication Bypass via Telegram Webhook
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...
CVE-2026-101050 Heym before 0.0.53 Authentication Bypass via Telegram Webhook
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...
CVE-2026-101050 Heym before 0.0.53 Authentication Bypass via Telegram Webhook
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...
EUVD-2026-87970
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...
CVE-2026-101050: Improper Authentication
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...
Malicious code in hw-api-secret (npm)
The package hw-api-secret was found to contain malicious code. --- Credit: OpenSSF source...
CVE-2026-77007 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected...
WordPress HEL Online Classroom: AI-powered Online Classrooms plugin <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure vulnerability
Unauthenticated BigBlueButton API Secret Disclosure vulnerability discovered by kimsunghoon in WordPress Plugin HEL Online Classroom: AI-powered Online Classrooms versions = 1.0.3...
WordPress Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates plugin < 3.7.1 - Unauthenticated API Secret Disclosure vulnerability
Unauthenticated API Secret Disclosure vulnerability discovered by Vaibhav Narkhede in WordPress Plugin WPLegalPages versions 3.7.1...
CVE-2026-81028 ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision
ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directory boundaries. The configuration loader in server/WebApi.cpp builds each root with File::absolutePath"", item, true; because the relative-path argument is emp...
CVE-2026-16984
The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...
CVE-2026-16984 WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure
The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...
CVE-2026-16984
The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin (versions before 3.7.1 ) is vulnerable to an unauthenticated API secret disclosure . The root cause is a missing authorization check on a REST route that returns stored account data...
EUVD-2026-66271
The Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates WordPress plugin before 3.7.1 does not include an authorization check on a REST route that returns stored account data, allowing unauthenticated visitors to retrieve the connected service's API secr...