CVE-2026-92794 OpenSign through 2.41.3 Information Disclosure via getDocument

OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identit...

CVE-2026-92794

OpenSign through version 2.41.3 is affected by an information disclosure vulnerability in the getDocument cloud function. When one-time-password (OTP) verification is disabled, the function fails to validate caller identity, allowing unauthenticated attackers to supply a document identifier obtai...

CVE-2026-92770

Harbor through 2.15.2 is affected by a scanner credential disclosure vulnerability. The root cause is an improper restriction on the q query parameter used for filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column t...

CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...

CVE-2026-92765 ArcherySec through 2.0.6 Information Disclosure via WebScanVulnList

ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizations. Attackers can supply arbitrary scan identifiers to retrieve complete web vulnerability data including titles,...

EUVD-2026-81034

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...

CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...

CVE-2026-92765

ArcherySec through version 2.0.6 contains an information disclosure vulnerability in the WebScanVulnList endpoint. The root cause is a failure to validate organization ownership, allowing any authenticated user to supply arbitrary scan identifiers and retrieve complete web vulnerability data —inc...

CVE-2026-92764

OpenCVE before 3.1.0 contains an authorization flaw in its organizations API endpoint . The endpoint fails to scope results to the organization associated with the bearer token, instead returning all organizations that the token creator belongs to. An attacker holding a valid organization-scoped ...

CVE-2026-92764 OpenCVE before 3.1.0 Organization API Ignores Token Scope

OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intended token isolati...

EUVD-2026-81032

OpenCVE before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning the token creator's memberships. Attackers with organization-scoped tokens can list and retrieve every organization their creator belongs to, bypassing intended token isolati...

EUVD-2026-81027

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basicauthpassword field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or...

CVE-2026-92759 SecObserve before 1.59.1 Information Disclosure via API Configuration

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basicauthpassword field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or...

CVE-2026-92759

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer component, which fails to strip the basic_auth_password field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configure...

CVE-2026-92759 SecObserve before 1.59.1 Information Disclosure via API Configuration

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basicauthpassword field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or...

CVE-2026-92750

Harness through 3.3.0 omits access control validation in its infrastructure provider read endpoint (GET /api/v1/infraproviders ), allowing any authenticated user to retrieve provider configurations from spaces they do not belong to. The exposed metadata includes Docker endpoints , TLS certificate...

EUVD-2026-81022

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to...

EUVD-2026-81160

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive information from network users that are outside the security group that the attacker is assigned to. This vulnerability exists because certain files lack proper...

CVE-2026-20072

CVE-2026-20072 is an information disclosure vulnerability in the web-based management interface of Cisco ISE . Certain files in the interface lack proper authorization enforcement, allowing an authenticated remote attacker with administrative privileges and management rights over network users to...

CVE-2026-76444

CVE-2026-76444 affects an internal service in Cisco Identity Services Engine (ISE) and Cisco ISE-PIC . The root cause is missing authentication on the Policy Runtime Repository Table (PRRT) service , allowing an unauthenticated, remote attacker to send a crafted request and retrieve sensitive con...