CVE-2026-54723 devpi: Database contents leak

devpi is a Python package index staging server and packaging, testing, and release tool. Prior to 6.20.2 and 7.0.0b3, a server configured with the primary or deprecated master role allows an unauthenticated, modified GET request to the +changelog route because verifyprimary does not reject a...

PT-2024-23109

Name of the Vulnerable Software and Affected Versions Serverpod versions prior to 1.2.6 Description An issue was identified with the old password hash algorithm used by Serverpod, making it susceptible to rainbow attacks if the database was compromised. The vulnerability is addressed by switching...

CVE-2023-27481: Exposure of Sensitive Information to an Unauthorized Actor

Directus is a real-time API and App dashboard for managing SQL database content. In versions prior to 9.16.0 users with read access to the password field in directususers can extract the argon2 password hashes by brute forcing the export functionality combined with a startswith filter. This allow...

PT-2023-21157

Name of the Vulnerable Software and Affected Versions Directus versions prior to 9.16.0 Description The issue allows users with read access to the password field in directus users to extract argon2 password hashes by brute forcing the export functionality combined with a starts with filter. This...