PT-2026-84295

Use of Hard-coded Credentials vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software allows Retrieve Embedded Sensitive Data. This issue affects Talassoft Industrial Management Software: from V.4 before V.16...

PT-2026-84504

Name of the Vulnerable Software and Affected Versions Scrapy versions prior to 2.17.0 Description The S3DownloadHandler in scrapy/core/downloader/handlers/s3.py converts S3-scheme bucket and key requests into plaintext HTTP requests unless the is secure variable in request.meta is explicitly...

Malicious code in agentwork-cli (npm)

Source: google-open-source-security 5e1924464368f0c5816ee84e000cc47017f44045140feafbbc9e685d847ed5a5 This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor. The package will steal credentials and then propogate it to every package it has access to...

CVE-2026-38577

Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access...

CVE-2026-82808

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be execut...

CVE-2026-82808

Inbox Foundry ActiveInbox Extension (up to version 7.10.24 , Chrome) ships a hard-coded Google OAuth Client Secret in the file dist/service-worker.production-esm.js . The vulnerability allows remote, unauthenticated attackers with no user interaction to leverage the exposed credential. The exploi...

CVE-2026-82808 Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be execut...

CVE-2026-82808 Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be execut...

EUVD-2026-68655

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be execut...

CVE-2026-82877

ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import...

CVE-2026-82877 ILIAS Arbitrary File Read via SOAP addFile

ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import...

CVE-2026-82877

ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import...

CVE-2026-82877 ILIAS Arbitrary File Read via SOAP addFile

ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import...

CVE-2026-49003

Attackers can exploit command injection vulnerabilities to delete core system runtime files, causing the monitoring module to crash and become paralyzed; simultaneously, they can obtain root privileges to steal configuration passwords such as SNMP, thereby tampering with critical system parameter...

CVE-2026-49003

CVE-2026-49003 is an unauthenticated command injection vulnerability in ZTE ZXDU68 S202 V5.0 , a power system product. Attackers on an adjacent network can exploit it without credentials to delete core system runtime files, causing the monitoring module to crash . They can also escalate to root p...

OPENSUSE-SU-2026:21135-1 Security update for chromium

This update for chromium fixes the following issues: Changes in chromium: - Chromium 149.0.7827.155 boo1268373: CVE-2026-12437: Use after free in WebShare CVE-2026-12438: Inappropriate implementation in WebView CVE-2026-12439: Use after free in Digital Credentials CVE-2026-12440: Use after free i...

CVE-2026-75760 AshAi vectorize change leaks raw embedding-provider errors, including credentials, in a user-facing error

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...

Exploit for CVE-2026-18963

0day-Exploits Vulnerability research I have done on four wide...

Exploit for CVE-2026-18963

My-Exploits Vulnerability research I have done on four widely...

CVE-2026-75760: Generation of Error Message Containing Sensitive Information

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...