EUVD-2026-79198

A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint...

CVE-2026-76672

CVE-2026-76672 affects the HPE Networking EdgeConnect SD-WAN Orchestrator . An authenticated remote attacker holding only read-only privileges can send a specially crafted request to the cache synchronization endpoint , leading to disclosure of sensitive third-party API tokens and credentials. Su...

CVE-2026-73465

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-73467

On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus TACACS+ servers...

CVE-2026-73466

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

CVE-2026-68529

Concrete CMS 9.0.0 through 9.5.2 contained an authorization bypass in the Express entries advanced-search dashboard action. The advanced_search() method in DashboardSelectableExpressEntryListTrait resolved an Express entity from a user-supplied entity ID without invoking canViewExpressEntries(), ...

CVE-2026-81567 Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated, blind extraction of arbitrary database content e.g. customer records, order data, stored credentials/tokens via boolean- or...

CVE-2026-73467 On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers

On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus TACACS+ servers...

EUVD-2026-79027

On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus TACACS+ servers...

CVE-2026-73466

CVE-2026-73466 affects Arista EOS , where plaintext user passwords may be written to log files (/var/log/agents/Aaa-*) under CWE-532 (Insertion of Sensitive Information into Log File). The precondition is that PyServer trace level 4 on agent Aaa is explicitly enabled via a non-standard debugging ...

CVE-2026-73466 On affected platforms running Arista EOS, under certain circumstances plaintext user passwords

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

CVE-2026-73466 On affected platforms running Arista EOS, under certain circumstances plaintext user passwords

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

EUVD-2026-79023

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-73465

CVE-2026-73465 is a CWE-532 (Insertion of Sensitive Information into Log File) vulnerability in Arista EOS . When MgmtSecuritySslCertKey trace levels 0, 3, and/or 4 are enabled on the ConfigAgent agent, plaintext RSA and EC private keys may be written to /var/log/agents/ConfigAgent-* log files. E...

CVE-2026-73465 On affected platforms running Arista EOS, under certain circumstances plaintext private keys

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-73465 On affected platforms running Arista EOS, under certain circumstances plaintext private keys

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-82837

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to...

CVE-2026-55375

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

CVE-2026-54549

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, the uploadadimage tool in metaadsmcp/core/ads.py passes an attacker-controlled imageurl to trymultipledownloadmethods in metaadsmcp/core/utils.py, where httpx.AsyncClient uses...

CVE-2026-39039

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...