CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

EUVD-2026-65084

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

ROOT-OS-DEBIAN-13-CVE-2025-68287 CVE-2025-68287 in linux - Patched by Root

Root has patched CVE-2025-68287 in the linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-68307 CVE-2025-68307 in linux - Patched by Root

Root has patched CVE-2025-68307 in the linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-71204 CVE-2025-71204 in linux - Patched by Root

Root has patched CVE-2025-71204 in the linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-39812 CVE-2025-39812 in linux - Patched by Root

Root has patched CVE-2025-39812 in the linux package for Root:Debian:13. Multiple fixed versions available...

Malicious code in tkyoussef-hb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf8b5edde28ed5fd92096c6a23ffb5ff8ec8272b6b52ec52c49d9cacab79ee69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: Langflow is affected by weaknesses in secret handling and sensitive configuration access

Summary Langflow includes features for secret protection, environment access, and runtime configuration of workflow components. Weaknesses in cryptographic key handling, exposure of process environment values, and insufficient restriction of sensitive runtime configuration fields could allow...

Security Bulletin: Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

Summary Langflow OSS supports custom Python components and validation of component code for component development workflows. Weaknesses in custom component execution paths, validation endpoints, and trusted template enforcement could allow authenticated users to execute arbitrary Python code or...

ROOT-OS-DEBIAN-13-CVE-2026-23375 CVE-2026-23375 in linux - Patched by Root

Root has patched CVE-2026-23375 in the linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-23251 CVE-2026-23251 in linux - Patched by Root

Root has patched CVE-2026-23251 in the linux package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2019-15213 CVE-2019-15213 in linux - Patched by Root

Root has patched CVE-2019-15213 in the linux package for Root:Debian:13. Multiple fixed versions available...

EUVD-2026-64890

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

CVE-2026-68520

A flaw was found in Glances, an open-source system monitoring tool. A remote unauthenticated attacker could exploit a vulnerability in the asdictsecure function, which incorrectly handles option names. This flaw leads to the exposure of sensitive information, including usernames and credentials...

CVE-2026-78370 RansomLook Unauthenticated Database Export Exposes Private Data

RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/ endpoint permits selected internal databases to be exported without requiring authentication. While...

CVE-2026-66585

Unauthenticated Sensitive Data Exposure in WP Cafe Pro 3.0.15 versions...

CVE-2026-21759

HCL Hive is affected by an information exposure vulnerability in which Swagger API documentation was publicly accessible to unauthenticated users. No sensitive data (credentials, PII) was discovered, but the exposure increases the overall attack surface by revealing API structure to potential att...

EUVD-2026-64837

HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information e.g., credentials, PII was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface...

CVE-2026-21759 HCL Hive is affected by an information exposure vulnerability

HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly. Although no sensitive information e.g., credentials, PII was discovered, exposing API documentation to unauthenticated users can increase the overall attack surface...

CVE-2026-66585

CVE-2026-66585 is an unauthenticated sensitive data exposure in the WP Cafe Pro WordPress plugin, affecting versions below 3.0.15 . The vulnerability allows remote attackers with no privileges to access sensitive data, yielding a CVSS 3.1 base score of 7.5 (HIGH) with high confidentiality impact ...