EUVD-2026-60161

Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114...

EUVD-2026-60110

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

CVE-2026-74891 openssl_encrypt before 1.4.0 Hardcoded Database Credentials

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

CVE-2026-74891 openssl_encrypt before 1.4.0 Hardcoded Database Credentials

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

MINI-VPFX-9G3P-J4W3

Bulletin has no description...

MINI-FV7X-HWF3-W93G

Bulletin has no description...

PT-2026-76865

Name of the Vulnerable Software and Affected Versions hermes-studio version 0.6.26 Description A directory traversal issue allows a remote attacker to obtain sensitive information. This occurs through the validatePath function within the 'api/hermes/download' endpoint. Directory traversal is a fl...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

PT-2026-76856

A logic issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to leak sensitive user information...

PT-2026-76734

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

CVE-2024-58375

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...

CVE-2024-58375

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...

EUVD-2024-55722

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...

CVE-2024-58375 OpenTofu before 1.8.3 Secret Variable Leaking via Static Evaluation

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...

CVE-2026-15056 StoreEngine <= 2.1.1 - Authenticated (Vendor+) Arbitrary File Read via Path Traversal in Downloadable File URL

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parsefilepath function. This makes it possible for authenticated attackers, with vendor-level...

CVE-2026-12905 Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment method of the Mobile Staff Cabinet API resource=appointment, action=booklymobilestaffcabinet in...

MINI-752G-W5MF-G56Q

Bulletin has no description...

CVE-2026-74247

A flaw was found in Red Hat Quay. A user with FEATUREBUILDSUPPORT enabled and repository write access can exploit a Server-Side Request Forgery SSRF vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network...

CVE-2026-17182

CVE-2026-17182 affects IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. It allows a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments (CWE-287). The vulnerability has a high impact: CVSS v3.1 base score 9.8 (...

CVE-2026-70631

A flaw was found in FFmpeg. An attacker can exploit an uninitialized heap memory disclosure vulnerability in the native TIFF decoder by providing a specially crafted TIFF file. This crafted file can cause the tiffunpackzlib function to include stale data from previous memory allocations in the...