CVE-2026-63158

The Omnispace Agora Project (versions before 26.10.0 ) is vulnerable to an authentication bypass via a Pass-the-Hash attack. The root cause is the legacy AGORAP_LOG/AGORAP_PASS cookie mechanism, which incorrectly treats stored bcrypt password hashes as replayable bearer credentials. An attacker w...

CVE-2026-45332: Exposure of Sensitive Information to an Unauthorized Actor

Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve the bcrypt password hash of every administrator account with a single POST request. The...

CVE-2024-5213

In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after login POST /api/request-token and after account creations POST /api/admin/users/new. This exposure occurs because the entire User object,...