CVE-2026-110474 Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which cou...

CVE-2026-110474

The CreditNirvana Agentic AI Call Centre application is vulnerable to a security flaw caused by a hardcoded static API Key within the client-side JavaScript bundle. An unauthenticated remote attacker can exploit this by downloading the JavaScript files to extract the key. Once obtained, the attac...

EUVD-2026-109786

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which cou...

CVE-2026-115718 Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...

CVE-2026-115718 Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...

CVE-2026-115718

Frappe Builder versions 1.33.0 before 1.36.0 are susceptible to a missing authorization vulnerability within the improve_prompt endpoint. This flaw allows any authenticated non-Guest session to bypass permission checks and invoke LLM completions. By calling the improve_prompt API, an attacker can...

EUVD-2026-109780

Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improveprompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improveprompt API to leverage the site owner's...

CVE-2026-97255

Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...

CVE-2026-97255 WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...

CVE-2026-97255

The Royal Elementor Addons plugin for WordPress (versions up to 1.7.1069 ) is vulnerable to an Authorization Bypass via user-controlled keys. The root cause involves Incorrectly Configured Access Control Security Levels , which allows for Insecure Direct Object References (IDOR) . An attacker can...

CVE-2026-97255 WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069...

Security Bulletin:Multiple vulnerabilities in bcpkix-jdk18on may affect IBM Infosphere Change Data Capture (CVE-2026-17508, CVE-2026-18036)

Summary Multiple security vulnerabilities have been identified in bcpkix-jdk18on, the Bouncy Castle Java APIs for CMS, PKCS, EAC, TSP, CMP, CRMF, OCSP, and certificate generation. bcpkix-jdk18on is used by IBM Infosphere Change Data Capture. IBM has addressed these vulnerabilities. Refer to the...

CVE-2026-103319 OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and...

CVE-2026-103319

The OPay Payment Gateway for WooCommerce WordPress plugin (versions

CVE-2026-103319 OPay Payment Gateway for WooCommerce <= 2.5.5 - Unauthenticated Payment Confirmation Forgery via Empty Default Secret Key

The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and...

Detect-CVE-2017-15361-TPM

Detect Trusted Platform Modules Vulnerable to CVE-2017-15361 This repository provides content for aiding DoD administrators in detecting systems that have an enabled Trusted Platform Module TPM that is vulnerable to CVE-2017-15361 and is a companion to Information Assurance Advisory RSA Key...

openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side

A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability...

Important: Red Hat Security Advisory: compat-openssl11 security update

An update for compat-openssl11 is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

EyesOfNetwork - Hardcoded API Key

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token. id: CVE-2020-8657 info: name:...