EUVD-2026-91147

An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103097

The GV-Eye Relay Payment API is vulnerable to an information disclosure flaw where an API key is hardcoded and retrievable from the application package. Because Android applications can be reverse-engineered, an unauthorized user can extract these sensitive credentials from the client application...

CVE-2026-103096 GV-Eye Hardcoded API Key Vulnerability

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103096 GV-Eye Hardcoded API Key Vulnerability

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

EUVD-2026-91146

API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key...

CVE-2026-103096

The GV-Eye application is vulnerable to a hardcoded API key issue. Because Android applications can be reverse engineered , an attacker can extract sensitive API credentials directly from the application package. This allows unauthorized users to misuse the key for unintended purposes. No specifi...

PT-2026-104253

YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge arbitrary semantic triples regardless of ownership. Attackers can send an empty filter to the triples delete endpoint to remove the admins-group membership...

PT-2026-104417

Name of the Vulnerable Software and Affected Versions Loom for AWS versions prior to 1.6.1 Description A missing authentication for a critical function in the authentication dependency allows remote actors to obtain super-admin authority over the agent control plane. This occurs in deployments...

CVE-2026-103956: Missing Authentication for Critical Function

Missing authentication for critical function in the authentication dependency in Loom for AWS before 1.6.1 allowed remote actors to obtain super-admin authority over the agent control plane, including registering tool servers, reading stored integration credentials, and rewriting the IAM role...

PT-2026-104167

Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer or a MITM can send a small BER-encoded response causing a large memory allocation before any data is received. This can lead to an OutOfMemoryError and denial of service. The client JVM OOMs...

PT-2026-104168

Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API versions 1.2.0 through 1.2.8 Description An unauthenticated client can trigger a stack overflow in the server's decoder by sending a deeply nested search filter before binding. Approximately 154 instances have been...

CVE-2026-97363: Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks or brute-force attacks to gain unauthorized access...

RabbitMQ 4.1.x < 4.1.11 / 4.2.x < 4.2.9 / 4.3.x < 4.3.3 Super Stream Binding Keys Denial of Service

The version of RabbitMQ installed on the remote host is 4.1.x prior to 4.1.11, or 4.2.x prior to 4.2.9, or 4.3.x prior to 4.3.3. It is, therefore, affected by a denial of service vulnerability: - The stream management HTTP API handler for super stream creation PUT...

Grafana Labs 12.0.x < 12.4.12 / 13.0.x < 13.0.10 / 13.1.x < 13.1.7 / 13.2.x < 13.2.3 Improper Authorization (CVE-2026-13720)

The version of Grafana Labs installed on the remote host is 12.0.x through 12.4.x prior to 12.4.12, or 13.0.x prior to 13.0.10, or 13.1.x prior to 13.1.7, or 13.2.x prior to 13.2.3. It is, therefore, affected by an improper authorization vulnerability: - An Editor can set file-provisioning metada...

ManageEngine Applications Manager < Build 182100 Multiple Vulnerabilities

According to its self-reported version number, the instance of ManageEngine Applications Manager running on the remote host is build 182000 or below and is not one of the fixed builds 181104 to 181109, 182001 to 182009. It is, therefore, affected by multiple vulnerabilities: - ZohoCorp ManageEngi...

EUVD-2026-91703

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoi...

PT-2026-104061

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An API key is hardcoded and can be retrieved from the application package. Because Android applications are susceptible to reverse engineering, embedding sensiti...

PT-2026-104431

Name of the Vulnerable Software and Affected Versions FileRise versions prior to 3.24.0 Description An information leak exists in the Pro add-on when at least one portal is configured. An unauthenticated user can retrieve the full internal record of a configured client portal by providing the...

Hardcoded JSON Web Tokens (JWT) in Brocade ASCG before 3.5.0 (CVE-2026-87424)

A vulnerability in the SupportLink API authentication component of Brocade ASCG versions prior to 3.5.0 allows an attacker to bypass authentication across deployments due to the use of a hard coded cryptographic key...

Unauthenticated Administrative REST API Access in Brocade ASCG before 3.5.0 (CVE-2026-85489)

An authentication flaw exists in the Brocade ASCG administrative management service component. An unauthenticated network user can issue direct API requests to perform privileged actions, including accessing sensitive system configuration mapping data, modifying managed device inventories, and...