Credential-and-breach-monitoring

Breach / Stealer-Log / Identity Exposure Services Comparison with Scoring This document compares breach intelligence, dark web monitoring, and identity exposure services across practical dimensions relevant to modern security teams. It focuses on: Breach corpus depth Infostealer-log coverage API...

CVE-2026-106126

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure SaaS allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe...

CVE-2026-106126

A command injection vulnerability exists in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) . This flaw allows an authenticated, low-privileged attacker to execute arbitrary commands with SYSTEM privileges on the PDCe . The root cause is identified as CWE-78 (Improper Neu...

CVE-2026-106126 Command Injection

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure SaaS allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe...

EUVD-2026-95207

A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure SaaS allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe...

CVE-2025-1868

CVE-2025-1868: Advanced IP Scanner & Advanced Port Scanner NTLM Leakage HTTP Tester Small dockerized PHP app that triggers an NTLM handshake and extracts the claimed domain , user , and workstation from NTLM Type 3 messages. It does not validate passwords. It does not store challenges. It only lo...

PT-2026-108189

Name of the Vulnerable Software and Affected Versions Tenable Identity Exposure SaaS affected versions not specified Description A command injection flaw exists in the Active Directory Events Listener. This allows an authenticated attacker with low privileges to execute arbitrary commands with...

CVE-2026-94213

CVE-2026-94213 affects the Authorization Services component of Keycloak , an open-source identity and access management solution. The flaw resides in the policy evaluation endpoint , used by administrators to test how access policies apply to specific users. Due to missing authorization checks , ...

Tenable Identity Exposure < 3.93.5 Multiple Vulnerabilities (TNS-2026-16)

The version of Tenable Identity Exposure running on the remote host is prior to 3.93.5. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-16: - Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/ that expose sensitive...

[R3] Tenable Identity Exposure Version 3.93.5 Fixes Multiple Vulnerabilities

R3 Tenable Identity Exposure Version 3.93.5 Fixes Multiple Vulnerabilities Aaron Roy Tue, 06/23/2026 - 16:43 Tenable Identity Exposure leverages third-party software to help provide underlying functionality. Several of the third-party components .NET Windows Server Hosting, NodeJS, Erlang OTP, SQ...

CVE-2026-13007 Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure

Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/ that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are...

CVE-2026-13007: Missing Authentication for Critical Function

Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/ that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are...

CVE-2026-56242 Capgo - Unauthenticated API Key Validity Oracle and User Identity Disclosure via get_identity_apikey_only RPC

Capgo before 12.128.2 contains an unauthenticated security definer RPC function getidentityapikeyonly that returns the owning userid for supplied API keys, creating an API key validity oracle and user identity disclosure primitive. Attackers can call this endpoint with valid or invalid API keys t...

Identity Exposure Management: Why It Matters

Millions of corporate credentials leak onto the public internet every single week. These exposed credentials act as open doors for threat actors looking to breach hybrid networks. When security teams rely only on legacy tools, they remain blind to these silent entry points. Book a HivePro demo to...

Identity Exposure Management: Risks and Response

Start with the path that carries risk. Security teams need a clear view of access risk. Stolen tokens and excessive privileges turn legitimate access into an attack route. Identity risk becomes urgent when one exposed account opens a path across critical systems. Identity exposure management is t...

CVE-2026-39966

TypeBot is a chatbot builder tool. In versions 3.15.2, the getLinkedTypebots API endpoint returns full bot definitions to any authenticated user who references a target bot ID in a Typebot Link block, regardless of workspace ownership, leading to IDOR. The authorization check uses Array.filter wi...

CVE-2026-8237 Concrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpoint

Concrete CMS 9.5.0 and below is vulnerable to IDOR. The /ccm/frontend/conversations/messagedetail endpoint returns the full content of any conversation message. An unauthenticated attacker can enumerate all conversation messages, including messages from restricted pages, member-only areas, and th...

How to Reduce Phishing Exposure Before It Turns into Business Disruption

What happens when a phishing email looks clean enough to pass through security, but dangerous enough to expose the business after one click? That is the gap many SOCs still struggle with: the attacks that leave teams unsure what was exposed, who else was targeted, and how far the risk has spread...

Tenable Identity Exposure < 3.77.17 Multiple Vulnerabilities (TNS-2026-11)

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.17. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-11: - A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictio...

Tenable Identity Exposure < 3.77.17 Multiple Vulnerabilities (TNS-2026-11)

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.17. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2026-11: - A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictio...