The Vault by Focused Hunts

The Vault Your Secrets. Your Control. Most password managers want you to trust a company you don't know with your sensitive data. They control the servers and the keys, and you have to hope nothing goes wrong. The Vault does things differently. Your encrypted vault files stay on cloud storage you...

CVE-2026-119664

Tamery formerly Conar 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and...

CVE-2026-119663

Tamery formerly Conar 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId i...

EUVD-2026-114080

Tamery formerly Conar 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and...

CVE-2026-119663 Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create

Tamery formerly Conar 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId i...

EUVD-2026-114079

Tamery formerly Conar 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId i...

CVE-2026-119663 Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create

Tamery formerly Conar 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId i...

CVE-2026-119663

The cloud sync API in Tamery (formerly Conar) versions 0.32.0 before 0.99.0 is vulnerable to a broken authorization flaw in the connectionsResources.create handler. This vulnerability allows authenticated users to attach resources to connections owned by other users. Specifically, an attacker who...

PT-2026-133593

Tamery formerly Conar 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId i...

PT-2026-133594

Tamery formerly Conar 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and...

CVE-2026-119664: wannabespace tamery: Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API…

Tamery formerly Conar 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and...

CVE-2026-119663: wannabespace tamery: Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API…

Tamery formerly Conar 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connection can include a victim's connectionId i...

CVE-2026-106035

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log...

CVE-2026-106035

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log...

CVE-2026-106035

The Ivanti Xtraction Cloud Sync software before version 2026.4 is vulnerable to an Information Exposure Through Log Files (CWE-532) vulnerability. A remote authenticated attacker can exploit this to disclose partial SQL database passwords via the application logs. No specific remediation or explo...

EUVD-2026-98847

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log...

CVE-2026-106035

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log...

PT-2026-111672

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log...

CVE-2026-106035: Insertion of Sensitive Information into Log File

An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial SQL database passwords through application log...

CVE-2026-107857

Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password to unencrypted AsyncStorage under @mindwtrcloudtoken and @mindwtrwebdavpassword. A party with access to the application...