CVE-2026-46670

YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path FormManager::create allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an INSERT statement and read the full database, includin...

CVE-2026-72609

An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition = orderreceive permission to read arbitrary database contents via the orderby request parameter in acqui/parcels.pl. The parameter is passed to...

EUVD-2026-56129

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = labelcreator permission to execute arbitrary SQL via the imagename field of a patron card layout. The imagename value is stored verbatim in the layout XML an...

CVE-2026-72607 Koha Community Koha - Stored SQL Injection via agefield in Automatic Item Modifications by Age

A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools = itemsbatchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The...

CVE-2025-13293

The affected product is TBEA TLogger with version 2.1.0.0B0.0.0.0. A hard-coded/default root credential allows an unauthenticated remote attacker to gain root access via the exposed SSH service. The root password can be recovered from the hash in /etc/shadow and used to authenticate to SSH, yield...

CVE-2026-48048

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the LiveTableResults, it is still possible to...

CVE-2026-48048

XWiki Platform is vulnerable due to an insufficient patch for GHSA-5cf8-vrr8-8hjm in the LiveTableResults endpoint. Affected versions are 6.2.1 and earlier than 18.0.0RC1, 17.10.13, 17.4.9, and 16.10.17. By sending slightly modified parameters to LiveTableResults, an attacker can reconstruct a us...

CVE-2026-48048 XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the LiveTableResults, it is still possible to...

Lotus Domino R5 and R6 WebMail - Information Disclosure

Lotus Domino R5 and R6 WebMail with 'Generate HTML for all fields' enabled which is by default allows remote attackers to read the HTML source to obtain sensitive information including the password hash in the HTTPPassword field, the password change date in the HTTPPasswordChangeDate field, and t...

CVE-2026-49005

The root password hash of the device can be obtained through unencrypted information in the firmware...

EUVD-2026-54357

The root password hash of the device can be obtained through unencrypted information in the firmware...

CVE-2026-49005 Root password hash exposure vulnerability in ZTE F689 product

The root password hash of the device can be obtained through unencrypted information in the firmware...

CVE-2026-71326 Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basicauth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and...

NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API

NPM: Ghost: Blind Password Hash Disclosure in Ghost Admin API vulnerability discovered by ? in WordPress Npm ghost versions 6.54.1...

CVE-2026-8794 PaperCut NG/MF: User enumeration via timing attack

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a...

GO-2026-6025 File Browser: Share API exposes the password hash and bypass token in github.com/filebrowser/filebrowser

File Browser: Share API exposes the password hash and bypass token in github.com/filebrowser/filebrowser...

Opaque, Interoperable Passkey Records (and a Go API)

Passkeys are the most important thing happening in information security right now because they are the only principled solution to the overwhelming effectiveness of phishing attacks. Just like memory safety is the only principled solution to memory corruption attacks. Unfortunately, implementing...

File Browser: Share API exposes the password hash and bypass token

Summary When a user creates a password-protected share or lists existing shares, the JSON response includes the full bcrypt passwordhash and the secret token of the share. The Link storage struct is serialized directly with json.Marshal and tags passwordhash and token for output, with no field...

GHSA-833G-CQHP-H72J File Browser: Share API exposes the password hash and bypass token

Summary When a user creates a password-protected share or lists existing shares, the JSON response includes the full bcrypt passwordhash and the secret token of the share. The Link storage struct is serialized directly with json.Marshal and tags passwordhash and token for output, with no field...

PT-2026-61811

Name of the Vulnerable Software and Affected Versions filebrowser versions prior to v2.63.16 Description When creating a password-protected share or listing existing shares, the application includes the full bcrypt password hash and the secret token in the JSON response. This occurs because the...