CVE-2026-0305

CVE-2026-0305 is currently a reserved candidate with no public technical details available in the provided documents. The affected product, root cause, and impact remain unspecified. Monitor for updates when the candidate is publicized.

CVE-2026-49364 Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommend...

CVE-2026-49364 Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommend...

CVE-2026-49364

Apache Artemis and JGroups lack sufficient access controls, allowing an unauthenticated network-adjacent attacker to spoof a password request in JGroups . This vulnerability enables an attacker to capture cluster administrative credentials during the initial connection handshake and gain manage-l...

CVE-2026-49364 Apache Artemis, Apache Artemis, Apache ActiveMQ Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers

An unauthenticated network-adjacent attacker can leverage discovery to capture cluster administrative credentials during the initial cluster connection handshake. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommend...

PT-2026-89386

Name of the Vulnerable Software and Affected Versions AVideo versions prior to c3edcc274c389816d434acadac07ee78eaf330c1 Description Incomplete sanitization of sensitive user fields occurs in the APIName=video response. The API::get api video function calls removeSensitiveUserFields only when the...

PT-2026-89469

Name of the Vulnerable Software and Affected Versions Amazon aws-agents-for-devsecops versions prior to 1.1.0 Description The AWS Security Agent plugin fails to verify the ownership of S3 buckets. This allows remote attackers to obtain the private source archive of a scanned workspace, which may...

VulnCheck KEV: CVE-2026-42018

JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources...

JetBrains YouTrack < 2026.2.18769 Information Disclosure (CVE-2026-86496)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18769. It is, therefore, affected by an information disclosure vulnerability: - In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses...

CVE-2026-88017: Exposure of Data Element to Wrong Session

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.64.0 until 1.75.1, the FTP auth-proxy driver in cmd/serve/ftp/ftp.go stores one obscured password per username in the server-wide userPass mapstringstring instead of binding the...

PT-2026-89404

OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown...

PT-2026-89446

Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration = 2.4.2 versions...

PT-2026-89394

Renovate is an automated dependency update tool. In versions before 44.14.4 and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0, log sanitisation for TLS private keys used for Mutual TLS was incomplete. While the value of...

CVE-2026-88874: Exposure of Sensitive Information to an Unauthorized Actor

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 does not enforce the Live stream password check on the stats endpoint or on the HLS origin. Live::getStats plugin/Live/Live.php returns a password-protected transmission's RTMP stream key, its isPasswordProtected...

PT-2026-89516

Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description Improper neutralization of regular-expression metacharacters in the LINQ query translation component allows an authenticated user to provide a character sequence that alters a...

JetBrains YouTrack < 2026.2.18634 Multiple Vulnerabilities

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18634. It is, therefore, affected by multiple vulnerabilities: - In JetBrains YouTrack before 2026.2.18634 unchecked group membership changes allowed privilege escalation. CVE-2026-86482 - In JetBrains YouTrack befo...

Linux Distros Unpatched Vulnerability : CVE-2026-61908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of- bounds index. An authenticated user could attempt to...

ROS-20260910-73-0101

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to confidential data...

ROS-20260910-73-0029

The vulnerability of the WebAppInstalls component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its integrity through a specially created HTML page...

CVE-2026-2310: XML Injection (aka Blind XPath Injection)

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...