CVE-2023-54403 Yonyou U8 CRM Arbitrary File Read via getemaildata.php

Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this...

CVE-2026-103548 Improperly Stored Credentials

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

CVE-2026-103548

The Itron MV-90 xi 3.0 contains improperly stored passwords within its configuration file. This vulnerability allows an attacker to decode both current passwords and password histories, potentially granting unauthorized access to the MV-90 application as any user. No specific remediation steps or...

CVE-2026-103548 Improperly Stored Credentials

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

CLEANSTART-2025-KZ78895 Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker

Security vulnerability affects the git package. Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker...

CLEANSTART-2025-CR90438 Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker

Security vulnerability affects the git package. Affected versions of Git have a vulnerability whereby Git can be tricked into sending private credentials to a host controlled by an attacker...

SUSE-SU-2026:23973-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin bsc1261939....

Security Bulletin: Langflow OSS is affected by server-side request forgery

Summary Langflow OSS provides integration connectors, API request components, and knowledge base vector store integrations that make outbound network calls. An attacker can craft network requests that bypass hostname validation, internationalized domain name handling, and URL restrictions. This...

CVE-2026-100264

In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host...

CVE-2026-100279

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials...

EUVD-2026-90023

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials...

CVE-2026-100270

In JetBrains YouTrack versions prior to 2026.2.19197 , a vulnerability exists where users with low-level Admin Read permissions can disclose integration credentials . This disclosure occurs specifically through the use of import configurations . The impact is a low-level confidentiality breach in...

CVE-2026-100270

In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations...

EUVD-2026-90014

In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurations...

CVE-2026-100264

In JetBrains YouTrack versions prior to 2026.2.18991 , stored SMTP server credentials could be disclosed. The vulnerability is triggered by changing the server host , potentially leading to the exposure of sensitive information. No specific exploit details or in-the-wild exploitation reports are ...

EUVD-2026-90008

In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host...

WordPress Newsletter – Send awesome emails from WordPress plugin <= 9.3.9 - Unauthenticated Insufficiently Protected Credentials vulnerability

Unauthenticated Insufficiently Protected Credentials vulnerability discovered by Swayam in WordPress Plugin Newsletter versions = 9.3.9...

CVE-2026-92960

A flaw was found in vm2. In configurations allowing built-in modules, vm2 fails to restrict access to the host operating system and Domain Name System DNS modules. An attacker who can execute code inside the sandbox can exploit this flaw to hijack the host process DNS resolver, redirecting outbou...

MAL-2026-17323 Malicious code in cortana-md-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a2de4b6992a1dd7177803253b8c214d1ba7cc911cf0e1e7f800e1e9ff7ab5b1 cortana-md-engine is a Baileys-based WhatsApp bot whose bundled entrypoints dist/hosted.cjs and dist/index.cjs hardcode five...

AlmaLinux 9.6 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc (ALMALINUX9.6:CLSA-2026:1768314331)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1768314331 advisory. - In the URI gem before 1.0.3 for Ruby, the URI handling methods URI.join, URImerge, URI+ have an inadvertent leakage of authentication...