CVE-2026-118984

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock o...

EUVD-2026-112722

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock o...

CVE-2026-118984

OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that allows holders of manage- or admin-scoped API keys or oma access tokens to change the management password without the current password. Attackers can send POST requests to /api/settings/require-login to lock o...

CVE-2026-118984

OmniRoute versions 3.8.0 before 3.8.52 are vulnerable to an unverified password change vulnerability. The flaw allows holders of manage-scoped or admin-scoped API keys, or oma_ access tokens, to change the management password without providing the current password. An attacker can exploit this by...

EUVD-2026-112460

A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrieving credentials fr...

aquatone

AQUATONE Aquatone is a tool for visual inspection of websites across a large amount of hosts and is convenient for quickly gaining an overview of HTTP-based attack surface. Installation 1. Install Google Chrome or Chromium browser -- Note: Google Chrome is currently giving unreliable results when...

PT-2026-129173

Name of the Vulnerable Software and Affected Versions ai-gateway-payload-processing affected versions not specified Description An authenticated remote attacker can perform unauthorized requests and consume another tenant's large language model LLM resources and quotas. The issue occurs because t...

Linux Distros Unpatched Vulnerability : CVE-2026-116218

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the...

CVE-2026-116691 MLflow CrewAI autologging records LLM provider API keys in logged trace spans

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog records CrewAI Agent objects without consistently sanitizing nested credential-bearing values...

CVE-2026-116691

The MLflow AI engineering platform is vulnerable in versions 2.19.0 through 3.17.0 due to insufficient sanitization of nested credentials during autologging. Specifically, the mlflow.crewai.autolog() function fails to scrub credential-bearing values when recording CrewAI Agent objects. The functi...

CVE-2026-116691 MLflow CrewAI autologging records LLM provider API keys in logged trace spans

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog records CrewAI Agent objects without consistently sanitizing nested credential-bearing values...

CVE-2026-114409

Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are...

CVE-2026-114409 Docker Desktop logs can expose stored third-party credentials

Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are...

EUVD-2026-110827

Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are...

CVE-2026-114409

Docker Desktop versions prior to 4.97.0 are vulnerable to the exposure of third-party API keys and OAuth access tokens. Due to insufficient IPC payload redaction , these credentials can be written in cleartext to local application logs and diagnostics bundles. An attacker with read access to thes...

PT-2026-126399

Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials. These OAuth tokens are...

PT-2026-127224

Name of the Vulnerable Software and Affected Versions MLflow versions 2.19.0 through 3.16.x Description MLflow leaks CrewAI LLM provider API keys into trace telemetry when mlflow.crewai.autolog is enabled. The issue occurs because MLflow serializes the dict of CrewAI Agent objects and converts...

CVE-2026-116634

OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider...

CVE-2026-116634

OmniRoute versions 3.8.50 before 3.8.52 are vulnerable to a missing authentication flaw (CWE-306). When requireLogin is disabled, unauthenticated attackers can issue sync tokens via POST /api/sync/tokens. These tokens can be used against GET /api/sync/bundle to retrieve decrypted provider credent...

CVE-2026-116634 OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens

OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against GET /api/sync/bundle to retrieve decrypted provider...