CVE-2026-66070: Permissive Cross-domain Policy with Untrusted Domains

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

CVE-2026-96548: Use of Hard-coded Credentials

A flaw has been found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssmpro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack's complexity ...

CVE-2026-92928: Use of Hard-coded Credentials

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account...

PT-2026-97601

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description An authenticated user can access sensitive information because of improper handling of encrypted credentials. This allows an attacker to obtain credentials intended for other user...

PT-2026-97521

A flaw has been found in sfturing hosp order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm pro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack's complexit...

PT-2026-97187

Name of the Vulnerable Software and Affected Versions Paymob for WooCommerce WordPress plugin versions prior to 4.1.14 Description Insufficient capability checks on several admin AJAX actions used to manage payment-gateway configuration allow users with contributor-level access to delete, wipe, o...

PT-2026-97574

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description When the Shovel plugin is enabled with URI-embedded credential...

PT-2026-97551

Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation controller affected versions not specified Description An issue exists where the external logging configuration for rsyslog is generated by interpolating user-controlled settings into an rsyslog...

PT-2026-97523

Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.12.0 through 7.2.9 Description An authenticated actor can execute arbitrary operating system commands as the openc3 service user. The issue occurs when the set setting method at the POST /openc3-api/api endpoint is use...

CVE-2026-77601: Improper Neutralization of Special Elements used in an OS Command

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypiurl setting through setsetting at POST /openc3-api/api, then cause OpenC3::PluginModel.installphase2 in...

CVE-2026-81208: Insufficiently Protected Credentials

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments...

CVE-2026-18124

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information due to insufficiently protected credentials...

CVE-2026-17644

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials...

CVE-2026-17643

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials...

CVE-2026-18124 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information due to insufficiently protected credentials...

CVE-2026-18124

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability where a local attacker can obtain sensitive information due to insufficiently protected credentials (CWE-522 ). This issue affects versions 4.0.6.0 through 4.0.10.0 (including specific iFix releases). The ...

CVE-2026-17644 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials...

CVE-2026-17644 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data due to the use of hard-coded credentials...

CVE-2026-17644

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability where the use of hard-coded credentials could allow a local attacker to gain unauthorized access to sensitive information and modify transaction data . The vulnerability has a CVSS 3.1 base score of 8.8 (H...

CVE-2026-17643 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials...