CVE-2026-86059 Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider...

CVE-2026-86059

Prior to version 0.29.13 , the self-hostable PaaS Dokploy suffered from a vulnerability where organization members without Git provider access could retrieve plaintext credentials. The root cause is that certain protected procedures for github.one , gitlab.one , gitea.one , and bitbucket.one fail...

CVE-2026-86059 Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider...

WordPress TrustedLogin Connector plugin <= 2.0.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Oly Hossen in WordPress Plugin TrustedLogin Connector versions = 2.0.3...

CVE-2026-75510

Novu's @novu/js In-App Inbox and @novu/react Inbox components (prior to version 3.18.0 ) are vulnerable to Stored XSS due to a lack of URL-scheme validation. An authenticated organization member or API-key holder can create a v1 in-app workflow with a call-to-action containing a javascript: redir...

EUVD-2026-84501

A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'themingenabled' with a trailing asterisk instead of the correct 'themingenabled'. In the MISP ACL system, the array values define which role o...

CVE-2026-93343 MarketKing < 2.1.72 Missing Authorization via marketking_admin_vendors_ajax

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingadminvendorsajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted AJAX request...

CVE-2026-93343 MarketKing < 2.1.72 Missing Authorization via marketking_admin_vendors_ajax

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketkingadminvendorsajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted AJAX request...

CVE-2026-95667 MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials

The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/mispinstall.log and a named pipe FIFO at /var/log/mispinstall.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...

EUVD-2026-84379

The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/mispinstall.log and a named pipe FIFO at /var/log/mispinstall.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...

CVE-2026-95667 MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials

The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/mispinstall.log and a named pipe FIFO at /var/log/mispinstall.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...

CVE-2026-95667

MISP installer scripts (for Debian 12 , Debian 13 , Ubuntu 24.04 , and RHEL 9.4 ) created a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe using the system default umask, resulting in world-readable permissions (0644) . The log captured sensitive c...

CVE-2026-92882 Redact SNMP community, SNMPv3 pass phrases, and IPMI password in host config REST API GET responses

Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases an...

EUVD-2026-84349

Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk 2.5.0p15, 2.4.0p37, 2.3.0p51 and 2.2.0 EOL allows an authenticated user who may view a host's configuration to read stored SNMP community strings, SNMPv3 auth and privacy pass phrases an...

CVE-2026-9004

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2026-9004 WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

EUVD-2026-84309

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2026-9004 WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2026-9004

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.4.6 . The root cause is a flaw in the 'contact_id' parameter, which allows authenticated attackers with contributor-level access or higher to ...

CVE-2026-86059: Exposure of Sensitive Information to an Unauthorized Actor

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider...