CVE-2026-84149

Manacle Technologies ERP System is affected by an information disclosure vulnerability caused by a publicly accessible .git directory . An unauthenticated remote attacker can retrieve repository metadata and associated files, potentially enabling reconstruction of the application's source code . ...

CVE-2026-84149 Information Disclosure Vulnerability in Manacle Technologies ERP System

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files,...

EUVD-2026-69059

This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unauthenticated remote attacker could exploit this vulnerability by accessing the exposed .git directory and retrieving repository metadata and associated files,...

Smart Contracts Claimed Vulnerable by the CVE Database, with Labels and Source Locations

The Common Vulnerabilities and Exposures CVE database catalogs vulnerability claims in hard- and software, among them those pertaining to blockchain programs a.k.a. smart contracts. We present CVE-Smart-Contracts, a curated dataset of CVE records up to July 2026 referring to Ethereum smart...

Security Bulletin: Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure (CVE-2026-3159)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to information disclosure. Vulnerability Details CVEID:CVE-2026-3159 DESCRIPTION: IBM IBM Sterling File Gateway is vulnerable to an information disclosure due to sensitive information being included...

Security Bulletin: Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due to information disclosure in mailbox UI (CVE-2026-3157)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to information disclosure in mailbox UI. Vulnerability Details CVEID:CVE-2026-3157 DESCRIPTION: IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through...

DakshSCRA v0.38-beta

Daksh SCRA Source Code Review Assist root@kitploit: Author: - Debasis Mohanty [email protected] - Twitter / X: @coffeensecurity - www.coffeeandsecurity.com About Daksh SCRA Daksh SCRA Source Code Review Assist tool is built to enhance the efficiency of the source code review process, providi...

EUVD-2026-63484

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/workspace/scripts/listsearch. The route-level scope middleware...

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

CVE-2026-52792

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

CVE-2026-52792

Algernon (a pure-Go web server) prior to 1.17.9 is vulnerable to server-side script source disclosure on Windows via NTFS filename aliasing. The root cause is in engine/handlers.go: filepath.Ext() does not recognize NTFS-equivalent suffixes (::$DATA, trailing dot, trailing space) as the script ex...

MINI-53WM-6QG2-GXQP

Bulletin has no description...

EUVD-2026-60112

opensslencrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any clientid to gain authenticated access to keyserver and telemetry APIs...

CVE-2026-50601

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

CVE-2026-50601

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

EUVD-2026-60025

A security vulnerability has been identified in the Planet9 desktop application where a hardcoded read-only API key permitted unauthorized access to internal repositories. An attacker could exploit this access to extract embedded administrative keys and secrets, potentially allowing them to gain...

CVE-2026-13460

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

CVE-2026-13460

CVE-2026-13460 affects IBM Storage Scale GUI, with versions 5.2.3.0–5.2.3.8 and 6.0.0.0–6.0.1.0 containing a hardcoded token in the GUI source used for inter-node cluster communication and REST API authentication. The security bulletin indicates fixes in 5.2.3.9 or later and 6.0.1.1 or later. Rem...

CVE-2026-13460

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

CVE-2026-58245

SAP Advanced Planning and Optimization Model Mix Planning contains a hardcoded credential within the source code of the application to perform authorization check to access certain functionalities in the application. An attacker with high privileges could leverage this hardcoded credential to...