FREEDOM Administration - Default Login

The Web GUI configuration panel of Hirsch formerly Identiv and Viscount Enterphone MESH through 2024 ships with default credentials username freedom, password viscount. The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires ma...

lama

lama Lama, the application that does not mince words. Description Lama is a GNU Linux tool to generate a word list. The goal is to obtain a custom password dictionary to a particular target, whether physical or moral. It is therefore important that words in this list correspond to the target. Kee...

CVE-2026-73008

Exposure of private personal information to an unauthorized actor in Windows Biometric Service allows an authorized attacker to disclose information locally...

CVE-2026-73008

CVE-2026-73008 is an information disclosure vulnerability in Windows Biometric Service . It allows a locally authenticated attacker with low privileges to expose private personal information to an unauthorized actor, resulting in high confidentiality impact with no integrity or availability impac...

CVE-2026-69351

Windows Universal Plug and Play (UPnP) Device Host contains an information disclosure vulnerability that allows a locally authenticated attacker with low privileges to expose private personal information without user interaction. The CVSS v3.1 score is 5.5 (Medium) with a high confidentiality imp...

EUVD-2026-73456

Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play UPnP Device Host allows an authorized attacker to disclose information locally...

CVE-2026-13177

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers...

CVE-2026-13177

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers...

CVE-2026-13177 Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers...

Valve warns Steam hardware buyers: Expect fake delivery scams

Most of us are wise to phishing emails that don't contain much personal information. Generic "your account is suspended" messages usually get binned on sight. But what about the phishing emails that use your real name and address, and reference the specific product you bought last month? Even for...

CVE-2026-17022

The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplyin...

CVE-2026-17022

The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplyi...

EUVD-2026-55005

The Salon Booking System WordPress plugin through 10.30.33 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplyi...

CVE-2026-17022 Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard

The Salon Booking System WordPress plugin before 10.30.34 does not properly validate a booking's ownership token before loading it in its booking-wizard confirmation steps, allowing unauthenticated attackers to disclose other customers' booking records, including personal information, by supplyin...

SUSE CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

Authentication Bypass by Primary Weakness

Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness in the HTTPS Agent. An attacker can impersonate a client by exploiting PFX object-array key collisions, which may result in mutual TLS client identities being reused across requests configured...

CVE-2026-15255

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

EUVD-2026-50999

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

CVE-2026-15255

CVE-2026-15255 affects the RegistrationMagic WordPress plugin prior to 6.0.9.4. The issue arises from improper validation of a one-time password in a cookie, enabling unauthenticated attackers to read other users’ form submission data (including personal information). Affected versions are

CVE-2026-15255 RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...