PT-2026-61626

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a Standard user can enumerate other users' names and email addresses...

CVE-2026-42218: Observable Response Discrepancy

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a timing side-channel vulnerability in the login interface. Due to a discrepancy in response processing times, a remote attacker can infer the existence of a username on the system, leading to unauthorized information disclosure...

Nimux 1.0.2

Nimux is a native command surface for authorized security assessments. It combines network enumeration, credential validation, Active Directory operations, Kerberos workflows, remote execution, file movement, secrets collection, DCSync, GPO operations, database clients, and SOCKS routing into one...

PT-2026-61666

Name of the Vulnerable Software and Affected Versions FreeScout versions prior to 1.8.219 Description An issue exists in the open tracking endpoint GET /thread/read/conversation id/thread id that allows unauthenticated attackers to enumerate valid conversation and thread IDs. Additionally, this...

CVE-2026-32819: Improper Authorization

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a Standard user can enumerate other users' names and email addresses...

CVE-2026-55544: Improper Access Control

NextCRM is open-source customer relationship management CRM software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens nxtc.... The application has an authorization model that restricts normal users to...

CVE-2026-57494: Authorization Bypass Through User-Controlled Key

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to GET /api/agenticmail/tasks/pending?assignee=...

oxo v2.9.3

OXO Scan Orchestration Engine OXO is a security scanning framework built for modularity, scalability, and simplicity. OXO Engine combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, and fingerprinting. Documentation Agents Store CLI...

CVE-2026-9323 Insecure PRNG and Information Exposure in urwid Web Display Backend

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...

CVE-2026-9323

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...

EUVD-2026-45381

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...

CVE-2026-58149

Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses...

CVE-2026-63307

Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/id endpoint. The handler calls dataSourceService.queryExistentid, ... without an ownership check and returns the decrypted password field, allowing any authenticated non-admin use...

CVE-2026-63101 Open Event Server 1.19.1 Unauthenticated Member Roster Export via CSV Export Endpoint

Open Event Server through 1.19.1 contains a missing authentication vulnerability that allows unauthenticated attackers to export the complete member roster of any group, including email addresses, names, join dates, and roles, by submitting requests to the group followers CSV export endpoint whic...

CVE-2026-63101

Open Event Server 1.19.1 is affected by an unauthenticated access vulnerability that lets attackers export the full member roster (emails, names, join dates, roles) by calling the group followers CSV export endpoint. The issue arises because the export endpoint lacks authentication and can be tri...

CVE-2026-58149 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0

Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses...

CVE-2026-58149 Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0

Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses...

CVE-2026-58149

The Joomla extension Events Booking (version

EUVD-2026-45200

The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses...

CVE-2026-58149

Joomla Extension - joomdonation.com - User enumeration in Events Booking 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses...