CVE-2026-66339

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials,...

CVE-2026-61884

Technical details are not publicly available in the provided documents. Monitor for updates from NVD/CVE and trusted advisories to confirm affected versions, root cause specifics, and remediation.

CVE-2026-55985

CVE-2026-55985 affects Tycon Systems TPDIN-Monitor-WEB2: the web management interface stores and displays system credentials in cleartext on a configuration page accessible to authenticated users. This exposure enables anyone with access to the administrative dashboard to read credentials, potent...

CVE-2026-65707

Likeshop through 3.0.5 contains an authenticated SQL injection vulnerability that allows admin-level users to extract arbitrary database contents by submitting unsanitized POST parameters to the adjustAccount endpoint. The adjustAccount method in UserLogic.php concatenates the money, integral,...

EUVD-2026-42618

Open WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission...

CVE-2026-66027

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...

EUVD-2026-48716

sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...

EUVD-2026-41116

AWS CLI: Overly permissive File Permissions...

EUVD-2026-48641

Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read pending prompt queues ...

CVE-2026-66005

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

CVE-2026-66005 Jan Local API Server CORS Origin Reflection via 0.0.0.0 Binding

Jan through 0.8.4, fixed in commit 3e1c1e7, contains a CORS misconfiguration vulnerability in its local API server that allows network-adjacent attackers to bypass trusted host restrictions by exploiting the server's replacement of user-configured trusted hosts with a wildcard that reflects...

electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

Summary In electron-builder's builder-util-runtime package, the HTTP redirect handler HttpExecutor.prepareRedirectUrlOptions only stripped a credential header whose key string matched exactly lowercase "authorization". Other credential-bearing headers — most notably PRIVATE-TOKEN used by GitLab's...

EUVD-2026-40455

electron-updater: Cross-origin redirect leaks PRIVATE-TOKEN and mixed-case Authorization credentials in builder-util-runtime...

CVE-2026-55729

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-55729 Loytec LWEB802: Exposure of Sensitive Information in browser localStorage

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

CVE-2026-55729

The CVE-2026-55729 entry concerns Loytec LWEB802 (before 5.0.8) where a vulnerability in the browser localStorage can expose management credentials. An unauthenticated remote attacker can leak credentials via a crafted link. Product: Loytec LWEB802; component: browser localStorage; root cause: in...

EUVD-2026-48594

Exposure of Sensitive Information CWE-200 in LWEB802 browser localStorage in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to leak stored management credentials via a crafted link...

Malicious code in karpatkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0a7a9ac195db3ed802d44e5d140f1425f53432c30aa0ddddfd46a91839fe8dff During import, the package exfiltrates sensitive data env variables, credential files, shell history, cryptocurrency wallet data etc.. It appears to be targeti...

Malicious code in karpatkey (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea7a30728a3c4f46fee3153895404941b4363cb7086f5efe55e9ae9931913395 During import, the package exfiltrates sensitive data env variables, credential files, shell history, cryptocurrency wallet data etc.. It appears to be targeti...

CVE-2026-14172

Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential Scan Engine or as root/SYSTEM Insight Agent. Fixed in Scan Engine content...