github-dorks

Github Dorks Github Search is a quite powerful and useful feature that can be used to search for sensitive data on repositories. Collection of Github dorks can reveal sensitive personal and/or organizational information such as private keys, credentials, authentication tokens, etc. This list is...

JFrog Artifactory 6.7.3 - Admin Login Bypass

JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allo...

CVE-2023-5070

CVE-2023-5070 Social Media Share Buttons & Social Sharing Icons = 2.8.5 - Information Exposure Description: The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.8.5 via the sfsisaveexport...

CVE-2026-121745

A flaw was found in Node Version Manager nvm. When downloading files or querying remote resources using custom authentication headers, authorization credentials are passed directly as command-line arguments to external download utilities. A local attacker on a shared system can observe running...

CVE-2026-118670

OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it...

CVE-2026-118670

OHIF Viewers is affected by a DOM-Based Cross Site Scripting (XSS) vulnerability in the dicom-pdf extension (versions 3.5.0-beta.0 through 3.12.15, 3.13.7, and 3.14.0-beta.19). The root cause is that the extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/di...

CVE-2026-88979

A flaw was found in Kubeflow Pipelines. The TensorBoard proxy relies on a publicly known default secret key to sign authentication tokens. In deployments where authorization is disabled, an unauthenticated remote attacker can forge authentication tokens to query internal cluster services on port ...

CVE-2026-118665

A flaw was found in GraphQL Tools legacy WebSocket executor. When an executor instance is reused across different authorization contexts, sensitive connection parameters such as authentication tokens are improperly retained after a connection closes. Consequently, a subsequent request lacking...

CVE-2026-118670: OHIF Viewers: OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages

OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it...

CVE-2026-54146

A flaw was found in OpenHuman. The desktop process exposes sensitive authentication tokens in its process environment, allowing other local processes running under the same user account to inspect and capture them. A local attacker can exploit this flaw to authenticate to the core service with th...

CVE-2026-121971

A flaw was found in Symfony HttpClient. The scoped HTTP client attaches default authentication credentials to requests before verifying that the resolved destination matches the intended trusted domain. A remote attacker who can control or influence the target URL can supply a specially crafted...

CVE-2026-121146

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session...

CVE-2026-121145

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of...

CVE-2026-121146

The iRA 2.0 and iRA.ev mobile applications by Tata Motors are vulnerable to an information disclosure flaw due to the recording of authentication tokens in application logs intended for development and debugging. A local attacker with access to these logs can retrieve and misuse the exposed sessi...

CVE-2026-121146 Information Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile application

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session...

EUVD-2026-116907

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session...

EUVD-2026-116905

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of...

CVE-2026-121145 Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView. Successful exploitation of...

CVE-2026-121145

The iRA 2.0 and iRA.ev mobile applications are vulnerable due to insufficient validation of URLs and origins loaded within the WebView component . A remote attacker can exploit this by sending malicious web content to the affected WebView. Successful exploitation may allow an attacker to interact...

CVE-2026-121146: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens…

This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vulnerability by retrieving and misusing the exposed session...