PT-2026-106227

Name of the Vulnerable Software and Affected Versions Newell Brands DYMO ID versions prior to 1.6.0 Description The software parses job files using the XmlDocument.Load function without disabling Document Type Definition DTD processing. The PC Job Files view automatically parses all recognized jo...

PT-2026-105996

Name of the Vulnerable Software and Affected Versions Northstar versions prior to 9.1.2 Description The software enables the H2 Console, but the authentication interceptor only covers the /northstar/ endpoint, leaving the /h2-console endpoint exposed without authentication. Additionally, the...

CVE-2026-88391

Northstar dromara/northstar, quantitative trading platform = 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar/, so /h2-console is exposed with no authentication and the embedded H2 DB uses default sa / empty password. Any network-reachable attacker can run arbitrary...

CVE-2026-88391

Northstar (dromara/northstar, quantitative trading platform) versions

CVE-2026-100103: Use of Default Credentials

Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the...

CVE-2026-105641: Use of Hard-coded Credentials

Plane is an open-source project management tool. Prior to 1.4.0, the deployments/aio/community/ and deployments/cli/community/ manifests provide fixed, publicly known SECRETKEY and LIVESERVERSECRETKEY defaults that remain active when operators do not override them. The top-level setup.sh randomiz...

CVE-2026-59785: Observable Response Discrepancy

Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it...

PT-2026-104803

Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it...

Linux Distros Unpatched Vulnerability : CVE-2026-81841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shar...

Linux Distros Unpatched Vulnerability : CVE-2026-105221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on- path attackers to intercept HTTPS traffic because...

Malicious code in oleh-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf2aebc282014a7dfa6ef1726083d23bcc9cc3eca76c814d4e775b7b10021545 Package [email protected] is a credential-harvesting phishing kit disguised as a wallet-connect modal component. It renders fake...

CVE-2026-105221

The gist RubyGem before version 6.1.0 is vulnerable to an improper certificate validation flaw. The root cause is located in lib/gist.rb, where the http_connection function sets VERIFY_NONE, effectively disabling TLS certificate verification. This allows on-path attackers to intercept HTTPS traff...

aws-vault

AWS Vault !WARNING Questo progetto è stato abbandonato e non riceverà più aggiornamenti. Se desideri continuare a ricevere aggiornamenti o contribuire, sentiti libero di dare un'occhiata al fork attivo su: https://github.com/ByteNess/aws-vault AWS Vault è uno strumento per archiviare e accedere i...

CVE-2026-105218

gopay before 1.5.119 disables TLS certificate verification in defaultClient in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment,...

CVE-2026-105147

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...

EUVD-2026-92093

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...

CVE-2026-105147 SciPhi-AI R2R JWT Secret hard-coded credentials

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...

CVE-2026-105147 SciPhi-AI R2R JWT Secret hard-coded credentials

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...

CVE-2026-105147

The SciPhi-AI R2R software (up to version 3.6.6 ) contains a vulnerability in the JWT Secret Handler component. The issue stems from the manipulation of the DEFAULT_BCRYPT_SECRET_KEY and DEFAULT_NACL_SECRET_KEY arguments, which leads to the use of hard-coded credentials . This vulnerability can b...

CVE-2026-105141

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...