12735 matches found
CVE-2026-73548
creationtimestamp| type| source ---|---|--- 2026-09-21 21:01:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mw2mbeoha62z...
CVE-2026-81469
creationtimestamp| type| source ---|---|--- 2026-09-21 21:01:30+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mw2mavlvy32m...
CVE-2026-94497
creationtimestamp| type| source ---|---|--- 2026-09-21 20:01:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mw2ivgdg3q2s...
CVE-2026-58491
creationtimestamp| type| source ---|---|--- 2026-09-21 19:20:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mw2glouoej2g 2026-09-21 20:07:30+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mw2jafcb6j2b 2026-09-22 00:03:05+00:00| seen|...
CVE-2026-94413
jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direc...
CVE-2026-94494
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user...
CVE-2026-49810
Dell Command Powershell Provider DCPP, versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...
CVE-2025-11395
creationtimestamp| type| source ---|---|--- 2026-09-21 18:58:12+00:00| seen| https://bsky.app/profile/mfahlandt.bsky.social/post/3mw2feiexsg2l 2026-09-22 20:12:19+00:00| seen| https://bsky.app/profile/podmanio.bsky.social/post/3mw4zxvya6225...
CVE-2026-61746
InvenTree , an open-source inventory management system, is vulnerable prior to 1.4.0 . The PluginSettingList , PluginAllSettingList , and PluginSettingDetail classes use GlobalSettingsPermissions without requiring IsAuthenticated, and since AuthRequiredMiddleware exempts /api/ paths, unauthentica...
CVE-2026-61746 InvenTree: Plugin-settings GET endpoints are readable without authentication
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...
CVE-2026-49810
Dell Command PowerShell Provider (DCPP) versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low-privileged attacker with local access can exploit this to achieve Information Disclosure . The Dell security advisory (DSA-2026-379) describes the issu...
CVE-2026-49810
Dell Command Powershell Provider DCPP, versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...
CVE-2026-94494
jshERP through 3.6 contains a tenant isolation bypass vulnerability in the GET /tenant/info endpoint (TenantController.java). Authenticated users can iterate the primary key to enumerate records of other tenants, exposing sensitive data such as login names, validity dates, user quotas, and enable...
CVE-2026-94494 jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user...
CVE-2026-94413 jshERP through 3.6 Password Hash Disclosure via /user/info
jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direc...
CVE-2026-94413 jshERP through 3.6 Password Hash Disclosure via /user/info
jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direc...
CVE-2026-94413
jshERP through 3.6 fails to redact password hashes in the /user/info endpoint. Authenticated users can retrieve unsalted MD5 password digests for any user by supplying arbitrary user IDs. The disclosed hashes are suitable for offline cracking or direct authentication bypass , enabling privilege e...
CVE-2026-61674
creationtimestamp| type| source ---|---|--- 2026-09-21 18:07:34+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mw2cjwmbns2t 2026-09-21 18:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mw2dacuhbl2t 2026-09-21 20:20:49+00:00| seen|...