AZL-99843 CVE-2026-19931 affecting package rust 1.90.0-10

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

grafana: tempo: loki: Tempo and Loki Datasource Plugins: Information disclosure and unauthorized actions via path traversal

A flaw was found in the Tempo and Loki datasource plugins. A remote attacker with a Viewer role could exploit a path traversal vulnerability by manipulating user-supplied input in URL paths. This could allow the attacker to capture sensitive administrator-configured datasource credentials, invoke...

CVE-2026-19931 Negotiate ambient user conn reuse

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

CVE-2026-19931 Negotiate ambient user conn reuse

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection...

Malicious code in multicore-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d643b52dafcb56aba0bd945697117be2a15447bcb4b183aabff3fa72824b75fb [email protected] is published under a spoofed author identity Blake Embrey, maintainer of array-flatten and advertises itself as an array utility,...

Malicious code in node-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e7475543fb41397ba49574f9b16340e671160b13bb100bb0db6c4acc2fb154e The package impersonates the legitimate blakeembrey/node-helper library matching author metadata, README, MIT license, and top-of-file helper functio...

EUVD-2026-72032

A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpapassphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly a...

CVE-2026-86150

A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpapassphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly a...

CVE-2026-86150 Tenda CP3 hostapd hard-coded credentials

A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpapassphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly a...

CVE-2026-86150

Tenda CP3 (firmware 27.5.57.101) is affected by a hard-coded credentials vulnerability in the file custom-x/softap/hostapd . Manipulation of the wpa_passphrase argument results in fixed credentials, which can be exploited remotely . The CVSS 4.0 score is 5.1 (Medium) with high privileges required...

CVE-2026-86150 Tenda CP3 hostapd hard-coded credentials

A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpapassphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly a...

Exploit for CVE-2026-18963

CVE-2026-18963-ke...

Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

JetBrains is urging Cadence users to revoke and rotate all credentials following a security incident last month in which unidentified threat actors exploited a recently disclosed critical vulnerability in TeamCity to breach its own environment. "Cadence users should immediately revoke or rotate a...

CVE-2026-84221 Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID

The Kirki WordPress plugin before 6.3.0 does not escape a user-supplied identifier before using it in a SQL query, allowing users with editor-level access and above to append arbitrary SQL and read the contents of the database, including user credentials...

EUVD-2026-71845

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...

EUVD-2026-71773

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents...

SUSE CVE-2026-73080

SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volumegrpcremote.go fetches a caller-supplied remote endpoint through weed/remotestorage/s3/s3storageclient.go and writes the response into a needle. The RPC performs no authentication and no...

CVE-2026-86175: Insufficiently Protected Credentials

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and secret keys for Git and Amazon S3 backends through API endpoints, gaining unauthorized access to...

CVE-2026-86150: Use of Hard-coded Credentials

A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpapassphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly a...

CVE-2026-15247: Missing Authorization

The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-priority handlers, allowing any authenticated user such as a Subscriber to overwrite or delete the site's stored Google service-account...