CVE-2026-78138: Exposure of Sensitive Information to an Unauthorized Actor

The Finale Lite WordPress plugin before 2.21.0 does not perform a capability check on an AJAX action that returns a sales-campaign's configuration for an arbitrary post ID, allowing any authenticated user Subscriber and above to read the Finale Lite WordPress plugin before 2.21.0's campaign...

PT-2026-82797

Name of the Vulnerable Software and Affected Versions Ebyte gateway product affected versions not specified Description The vendor configuration utility fails to require authentication for certain disruptive administrative actions when default credentials are still in use. This allows an...

CVE-2026-77977: Missing Authentication for Critical Function

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings,...

PT-2026-82836

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API user can read the cleartext cluster key from a configuration endpoint that fails to redact it. The REST API provides a...

CVE-2020-12712

CVE-2020-12712: SOS JobScheduler में संग्रहीत पासवर्ड का डिक्रिप्शन इस रिपॉजिटरी में स्क्रिप्ट आपको JobScheduler इंस्टेंस के लिए SFTP कॉन्फ़िगरेशन फ़ाइल में संग्रहीत पासवर्ड को डिक्रिप्ट करने की अनुमति देती है। विवरण SOS JobScheduler एक रिमोट सिस्टम प्रशासन टूल है जो उपयोगकर्ताओं को वेब इंटरफ़ेस ...

CVE-2026-75338

disconf Distributed Configuration Management Platform 2.6.36 is vulnerable to Incorrect Access Control. The config-fetching APIs /api/config/item, /api/config/file, /api/config/list and /api/config/simple/list are exposed without authentication. The LoginInterceptor explicitly whitelists these fo...

CVE-2026-21808

HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an attacker with internal application logic and architectural details...

CVE-2026-65956

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...

CVE-2026-65956

KubePi (a Kubernetes multi-cluster management panel) versions up to 1.6.15 expose SSO, OIDC, and SAML configuration API endpoints on the same public routing boundary as login and callback endpoints, requiring no administrator authorization. An unauthorized or low-privileged user can read, create,...

CVE-2026-65956 KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...

EUVD-2026-66810

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...

CVE-2026-65956 KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...

CVE-2026-65956 KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without...

CVE-2026-75329

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

UBUNTU-CVE-2026-75329

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

CVE-2026-75329

The Netty configuration distribution service port 8283 of super-diamond-server = 1.3.3 has no authentication mechanism. Attackers can directly obtain the full configuration of any project including database passwords, API keys, etc. by sending a TCP request without any credential...

CVE-2026-21808 HCL BigFix Quantum Risk Analyzer is affected by logging sensitive information

HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an attacker with internal application logic and architectural details...

CVE-2026-21808

HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default, which can expose sensitive data and reveal internal application logic and architectural details to an attacker. The flaw is scored CVSS 4.1 (MEDIUM) , requiring a local attack with high complexity and high ...

CVE-2026-47843

In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...

CVE-2026-47843 Reactor Netty may incorrectly route traffic due to DNS resolver reuse

In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrectly reuse a previously configured DNS resolver. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier...