CVE-2026-105147 SciPhi-AI R2R JWT Secret hard-coded credentials

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...

CVE-2026-105147 SciPhi-AI R2R JWT Secret hard-coded credentials

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...

CVE-2026-105147

The SciPhi-AI R2R software (up to version 3.6.6 ) contains a vulnerability in the JWT Secret Handler component. The issue stems from the manipulation of the DEFAULT_BCRYPT_SECRET_KEY and DEFAULT_NACL_SECRET_KEY arguments, which leads to the use of hard-coded credentials . This vulnerability can b...

CVE-2026-105141

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105141 topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

EUVD-2026-92086

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105141 topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105141

The topoteretes cognee software (versions up to 1.5.4 ) contains a security flaw in the JWT Signing Key Handler component. Specifically, the get_user_id_by_email function within the file cognee/modules/users/authentication/get_api_auth_backend.py allows for the manipulation of the FASTAPI_USERS_J...

CVE-2026-105141 topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105165: Incorrect Permission Assignment for Critical Resource

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be...

PT-2026-104651

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process single secret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument external id leads to incorrect permission assignment. The attack can be...

PT-2026-104658

A security flaw has been discovered in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This impacts an unknown function of the file delivery/delivery.php of the component Take Order Handler. The manipulation of the argument...

CVE-2026-105156: Use of Password Hash With Insufficient Computational Effort

A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launch...

CVE-2026-105147: Use of Hard-coded Credentials

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...

PT-2026-104660

A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected by this vulnerability is an unknown functionality of the file admin/admin.php of the component Role Attribute Handler...

PT-2026-104623

Name of the Vulnerable Software and Affected Versions SciPhi-AI R2R versions prior to 3.6.7 Description The JWT Secret Handler component contains hard-coded credentials. This issue occurs due to the manipulation of the DEFAULT BCRYPT SECRET KEY and DEFAULT NACL SECRET KEY arguments, which allows ...

PT-2026-104626

A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launch...

PT-2026-104644

A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade...

PT-2026-104617

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get user id by email of the file cognee/modules/users/authentication/get api auth backend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPI USERS JWT...

CVE-2026-105141: Use of Hard-coded Credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...