EUVD-2026-65445

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...

CVE-2026-79669 Ech0 before 4.4.3 Missing Authorization on System Logs

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...

CVE-2026-79669 Ech0 before 4.4.3 Missing Authorization on System Logs

Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather...

CVE-2026-79666

Ech0 versions before 4.4.3 fail to enforce administrator authorization on dashboard log endpoints. Any authenticated user can query GET /api/system/logs and subscribe to SSE and WebSocket log streams, retrieving sensitive operational data including file paths, stack traces, and internal URLs . Th...

EUVD-2026-65448

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...

CVE-2026-79666 Ech0 before 4.4.3 Missing Authorization via dashboard log endpoints

Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data...

EUVD-2026-65454

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without...

CVE-2026-79660

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model . Unauthenticated attackers can harvest all commenter emails by calling the /api/comments and /api/comments/public endpoints without any auth...

CVE-2026-21758

HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment...

EUVD-2026-65471

HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment...

CVE-2026-21758 HCL Hive is affected by multiple security vulnerabilities.

HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment...

CVE-2026-21758

HCL Hive is affected by an information disclosure vulnerability that could allow an attacker to gather sensitive information about the host environment . The CVSS v3.1 score is 3.7 (LOW) , with a network attack vector, high attack complexity , no required privileges, and low confidentiality impac...

CVE-2026-77136

creationtimestamp| type| source ---|---|--- 2026-08-25 10:07:25+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtvl4jgnnx25 2026-08-25 10:28:13+00:00| seen| https://bsky.app/profile/securityonline.bsky.social/post/3mtvmbpb3su2y 2026-08-25 20:50:07+00:00| seen|...

CVE-2026-56136

A flaw was found in NTFS-3G. An out-of-bounds read vulnerability exists that allows a remote attacker to read potentially confidential information within an ntfs-3g process. This can be triggered by crafting a malicious NTFS image and creating a file with a specially crafted name. Mitigation To...

CVE-2026-19542

A flaw was found in glibc. An out-of-bounds array write vulnerability exists within the tdelete function. This issue occurs due to incorrect management of array sizes, which can lead to memory corruption. A local attacker with low privileges could potentially exploit this to cause a denial of...

CVE-2026-77128

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...

CVE-2026-77131

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

CVE-2026-77127

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...

CVE-2026-56093

The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access...

CVE-2026-56096

The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values...