CVE-2026-114219

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information...

CVE-2026-114219 NewType Infortech｜NT OneAPP - Hard-coded Credentials

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information...

EUVD-2026-108002

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information...

CVE-2026-114219

The NT OneAPP application developed by NewType Infortech is susceptible to a Hard-coded Credentials vulnerability (CWE-798). Unauthenticated remote attackers can retrieve the hard-coded cryptographic key to decrypt login request contents. This allows attackers to obtain users' plaintext account c...

CVE-2026-96890

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

EUVD-2026-93667

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

CVE-2026-96890 Server-Side Request Forgery vulnerability was identified in GitHub Enterprise Server that allowed requests to attacker-controlled internal hosts

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

CVE-2026-96890

A Server-Side Request Forgery (SSRF) vulnerability exists in GitHub Enterprise Server (versions 3.20, 3.21, and 3.22). The flaw stems from the secret scanning validator for GCP service account credentials , which trusted the token endpoint embedded in a committed credential and issued requests wi...

PT-2026-107128

Name of the Vulnerable Software and Affected Versions GitHub Enterprise Server versions 3.20 through 3.20.8 GitHub Enterprise Server versions 3.21 through 3.21.6 GitHub Enterprise Server versions 3.22 through 3.22.1 Description A Server-Side Request Forgery SSRF issue exists where the secret...

CVE-2026-96890: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret...

Service Account Credentials File Disclosure Detection

Service Account Credentials internal file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Service Account Credentials internal file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Service Account...

EUVD-2026-44666

ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthenticated remote attacker to retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot. This...

CVE-2026-46458 Credential exposure in ICU Scandinavia Boomerang

ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthenticated remote attacker to retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot. This...

CVE-2026-46458

ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthenticated remote attacker to retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot. This...

CVE-2026-46458 Credential exposure in ICU Scandinavia Boomerang

ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthenticated remote attacker to retrieve plaintext service account and SMTP credentials by requesting specific XML files from the webroot. This...

CVE-2026-15291

The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the REST API endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/id. This is due to the plugin not performing any...

CVE-2026-48206

Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel JIRA component. The camel-jira producers read their operation parameters - the issue key, project key, transition id, summary, type, assignee, components, watchers, link type, work-log minute...

CVE-2026-9183

The 24liveblog - live blog tool plugin for WordPress is vulnerable to Exposure of Sensitive Information in versions up to, and including, 2.2. This is due to the lb24blockenqueuescripts function being hooked to enqueueblockeditorassets and, for any non-administrator user, falling back to loading...

CVE-2026-56225

Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers get/put/delete/post. API keys created with mode=all but restricted to a single app via limitedtoapps are only checked for limitedtoorgs and not for limitedtoapps, so an app-scoped key ca...

CVE-2026-56225

Capgo before 12.128.2 contains an authorization bypass vulnerability in its public API key management handlers get/put/delete/post. API keys created with mode=all but restricted to a single app via limitedtoapps are only checked for limitedtoorgs and not for limitedtoapps, so an app-scoped key ca...