Insufficiently Protected Credentials

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the offsetGet process. An attacker can retrieve sensitive user information, such as hashed passwords...

Insufficiently Protected Credentials

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the Twig sandbox configuration, which contains an incomplete default denylist. An attacker can access...

Exploit for CVE-2026-18963

CVE-2026-18963 Keycloak reset-credentials bypass → unauthenti...

Exploit for CVE-2026-18963

CVE-2026-18963 Keycloak reset-credentials bypass → unauthent...

Exploit for CVE-2026-18963

CVE-2026-18963 — Lab tái dựng lại Keycloak reset-credentials...

CVE-2026-65087: Insufficiently Protected Credentials

NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials . A successful exploit of this vulnerability might lead to information disclosure and data tampering...

CVE-2026-76839: Insufficiently Protected Credentials

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

PT-2026-81451

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require use...

PT-2026-81454

CAI Content Credentials is affected by an Integer Underflow Wrap or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not...

PT-2026-81866

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 29.0.3 Description Tokens obtained through OAuth1 access tokens, application credentials, or trust-scoped authentication can be used to create new long-lived credentials or authorize new delegations. These...

PT-2026-81193

Name of the Vulnerable Software and Affected Versions FA-50 affected versions not specified Description The software contains hard-coded credentials. An attacker with access to the internal network of the vessel can use these credentials to access the settings screen and alter the identification...

PT-2026-81348

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description The Jobs API in PraisonAI lacks authentication middleware, router-level dependencies, and per-route authorization checks. This allows any caller who can reach the jobs server to submit agent jobs...

JetBrains TeamCity < 2019.2.2 (CVE-2020-11687)

The version of JetBrains TeamCity installed on the remote host is prior to 2019.2.2. It is, therefore, affected by a vulnerability: - In JetBrains TeamCity before 2019.2.2, password values were shown in an unmasked format on several pages. CVE-2020-11687 Note that Nessus has not tested for this...

PT-2026-81447

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue...

CVE-2026-80182: Incorrect Authorization

In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or authorize new delegations that persist independently of, and outlive, the credential used to obtain them. The delegation...

CVE-2026-76198: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user...

CVE-2026-71444: Integer Underflow (Wrap or Wraparound)

CAI Content Credentials is affected by an Integer Underflow Wrap or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not...

CVE-2026-71443: Improper Input Validation

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require use...

CVE-2026-55539: Missing Authentication for Critical Function

PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.51, the Jobs API createapp function mounts /api/v1/runs without authentication. Any reachable caller can submit jobs, read results, cancel runs, or delete jobs using operator credentials. The fix adds PRAISONAIJOBSAPIKEY middleware f...

CVE-2026-59769: Use of Hard-coded Credentials

FA-50 all versions contain hard-coded credentials. An attacker, who knows the credentials and has access to the vessel's internal network, can operate the settings screen using that credentials to alter the identification number...