CVE-2026-100862 heym before 0.0.91 Multiple Secrets Plaintext Storage

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100862

The workflow automation platform heym versions prior to 0.0.91 contains multiple plaintext storage vulnerabilities. The application fails to encrypt several sensitive secrets, including webhook header-auth values , MCP API keys , portal session tokens , workflow execution JWTs , and Discord inter...

CVE-2026-100862: Cleartext Storage of Sensitive Information

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-100871: Improper Authentication

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. Attackers can register a shop customer account using an administrator's email address and obtain a token that the Admin API...

CVE-2026-101061: Server-Side Request Forgery (SSRF)

utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of CVE-2026-44661 fixes. The GraphQL plugin uses a vulnerable prefix check allowing bypass URLs like http://127.0.0.1.attacker.example, while the WebSocket plugi...

CVE-2026-100709 Froxlor before 2.3.12 2FA Bypass via Namespace Confusion

Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens panel2fatokens without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated...

CVE-2026-100709

Froxlor versions through 2.3.10 are vulnerable to a second-factor bypass due to a namespace confusion in remembered-2FA tokens (panel_2fa_tokens ). The system stores only a numeric user ID without recording the account namespace, and the lookup is not constrained to specific account types. Conseq...

CVE-2026-100709 Froxlor before 2.3.12 2FA Bypass via Namespace Confusion

Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens panel2fatokens without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated...

EUVD-2026-87682

Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens panel2fatokens without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated...

CVE-2026-100681 Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook

Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an...

CVE-2026-100709: Improper Authentication

Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens panel2fatokens without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated...

CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

CVE-2026-100502

Flame through version 2.4.0 is vulnerable to an insufficient session expiration vulnerability in its login endpoint. Attackers who possess former administrator access can exploit unvalidated duration parameters to obtain tokens with arbitrary lifespans. Because tokens are verified against a stati...

CVE-2026-100502 Flame through 2.4.0 Admin Token Insufficient Session Expiration

Flame through 2.4.0 contains an insufficient session expiration vulnerability in the login endpoint that allows attackers with former admin access to obtain tokens with arbitrary lifespans by supplying unvalidated duration parameters. Attackers can mint near-permanent administrator tokens that...

CVE-2026-5267 Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS

Ciena Navigator Network Control Suite NCS contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive...

CVE-2026-5267 Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS

Ciena Navigator Network Control Suite NCS contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive...

CVE-2026-63208 Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...

CVE-2026-63208 Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...

BIT-RCLONE-2026-79780 rclone before v1.75.0 Credential Exposure via S3 Redirect

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...