PT-2026-96135

Name of the Vulnerable Software and Affected Versions GoCD versions prior to 26.1.0 Description GoCD can return unmasked credentials stored in the userinfo portion of source control material URLs. This occurs through several read-only APIs available to regular authenticated users. While dedicated...

Linux Distros Unpatched Vulnerability : CVE-2026-93748

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticate...

CVE-2026-88756

Pagekit CMS versions

CVE-2026-88756

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

CVE-2026-88756

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

PT-2026-96134

Name of the Vulnerable Software and Affected Versions GoCD versions 16.1.0 through 26.0.0 Description Internal material connection test APIs at '/go/api/admin/internal/material test' and '/go/api/internal/config repos//material test' accept an arbitrary existing pipeline and pipeline-group contex...

PT-2026-96141

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.91.1 Description The SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go performs an http.Get request on the UnsubscribeURL parameter within the payload. Because the BuildSignature...

PT-2026-96186

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0 Description An authenticated user can update a notifier belonging to another tenant by providing the target notifier UUID to the 'PUT /v1/notifiers/id' endpoint. This occurs because the NotifierRepository.Updat...

CVE-2026-88756: Improper Neutralization of Special Elements used in an SQL Command

Pagekit CMS = 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public login endpoint POST /user/authenticate...

CVE-2026-94215: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...

CVE-2026-48976: Insufficiently Protected Credentials

HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/reponotifier.go updates a notifier through UpdateOneIDid without requiring the record's user ID to match the authenticated user. An authenticated user who supplies another...

PT-2026-96261

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.5-lts Description Authenticated workspace members can inject control characters into the AWS Bedrock access key id and secret access key fields. These values are processed by the update aws credentials function and...

Linux Distros Unpatched Vulnerability : CVE-2026-92768

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine VM credentials, including plaintext...

CVE-2026-94112 mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

CVE-2026-94112 mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acceptance window. Attackers with stolen credentials can authenticate and reuse a captured passcode against multiple authorization attempts for approximately 90...

CVE-2026-93970

A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the component Settings Handler. The manipulation results in hard-coded credentials. The attack may be performed from remote. The patch is...

CVE-2026-93969

A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensuredefaultsuperuser of the file rbac/services.py. The manipulation leads to hard-coded credentials. The attack is possible to be carried out remotely. The identifier of the patch is...

EUVD-2026-83706

A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the component Settings Handler. The manipulation results in hard-coded credentials. The attack may be performed from remote. The patch is...

CVE-2026-93970

aiyiyi121 SxDevOps (versions 1.0/1.1) contains a hard-coded credentials vulnerability in the file backend/sxdevops/settings.py within the Settings Handler component. The flaw is exploitable remotely over the network with no required privileges or user interaction, rated CVSS 3.1: 7.3 (HIGH) with ...

CVE-2026-93970 aiyiyi121 SxDevOps Settings settings.py hard-coded credentials

A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the component Settings Handler. The manipulation results in hard-coded credentials. The attack may be performed from remote. The patch is...