60847 matches found
CVE-2026-72539
An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...
EUVD-2026-56038
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents...
CVE-2026-72539
An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...
EUVD-2026-56009
An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...
CVE-2026-72539
Summary : CVE-2026-72539 affects Windmill Labs Windmill up to version 1.783.0, causing information disclosure. Affected component : drafts data store accessed via the Windmill drafts endpoint. Root cause : legacy ownerless drafts with null owner emails bypass ACL enforcement, allowing any authent...
Malicious code in lines-columns (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c9abe51d09dfaa6a2e38e60df64038009c1029b34587cc2c8906d37642187cd Package name 'lines-columns' closely resembles the popular 'lines-and-columns' package, and the README instructs users to install 'lines-and-columns'...
CVE-2026-58231
Technical details about CVE-2026-58231 are not publicly available in the provided documents. Monitor for updates.
EUVD-2026-55999
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high...
CVE-2026-19391
A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords ldapdefaultauthtok and Pacemaker fence device credentials to be included in cleartext in archives uploaded to...
CVE-2026-19391
A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords ldapdefaultauthtok and Pacemaker fence device credentials to be included in cleartext in archives uploaded to...
CVE-2026-19391
A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords ldapdefaultauthtok and Pacemaker fence device credentials to be included in cleartext in archives uploaded to...
CVE-2026-61632 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-58245
CVE-2026-58245 concerns SAP Advanced Planning and Optimization (Model Mix Planning), where a hard-coded credential in the application’s source enables an attacker with HIGH privileges and no user interaction to bypass authorization and delete specific planning-related restrictions. The descriptio...
PT-2026-70568
Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Insufficiently protected credentials allow an authorized attacker to perform spoofing over a network, which enables them to affect the system. Recommendations At the momen...
PT-2026-70035
Name of the Vulnerable Software and Affected Versions SAP Advanced Planning and Optimization Model Mix Planning affected versions not specified Description The application contains a hardcoded credential within its source code used for authorization checks when accessing specific functionalities...
PT-2026-70378
CAI Content Credentials is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user...
PT-2026-70781
CAI Content Credentials is affected by an Integer Underflow Wrap or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not...
PT-2026-70782
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user...
PT-2026-70103
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A path traversal vulnerability exists in the Offline archives functionality of the local web interface. This issue occurs because of insufficient validation of a...
PT-2026-70215
Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2024 SU7 Description Cleartext transmission of sensitive information in the Core of Ivanti Endpoint Manager allows a remote unauthenticated attacker in a Man-in-the-Middle MITM position—where an attack...