Scout2

AWS Scout2 .. image:: https://travis-ci.org/nccgroup/Scout2.svg?branch=master :target: https://travis-ci.org/nccgroup/Scout2 .. image:: https://coveralls.io/repos/github/nccgroup/Scout2/badge.svg?branch=master :target: https://coveralls.io/github/nccgroup/Scout2 .. image::...

Trinity Audio <= 5.21.0 - Information Exposure

The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the /admin/inc/phpinfo.php file that gets created on install. This makes it possible for...

Wavlink WL-WN533A8 M33A8.V5030.190716 - Information Disclosure

An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials. id: CVE-2022-48164 info: name: Wavlink WL-WN533A8 M33A8.V5030.190716 - Information...

WordPress 3D FlipBook <= 1.16.17 - Information Disclosure

WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions = 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3dsendpostsin, fb3dsendpostpages, fb3dsendpostsinpages, fb3dsendpostsinfirstpage, and fb3dsendpostfirstpage handlers are...

CVE-2026-120823

A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluster-level privilege. This may result in...

CVE-2026-120823

A missing authorization check in the MongoDB Server aggregation framework allows a user with any valid credentials—including an account with no assigned roles—to access deployment-wide query configuration data . This data is normally restricted to cluster-level privileges, and unauthorized access...

CVE-2026-25049

🚨 CVE-2026-25049 – n8n Unauthenticated Settings Disclosure 📌 Overview CVE ID: CVE-2026-25049 Affected Software: n8n Severity: Critical Category: Improper Access Control / Information Disclosure This vulnerability allows unauthenticated access to internal configuration data via a REST API endpoint...

CVE-2025-56801

CVE-2025-56801 AES-CFB IV Generation Vulnerability in Reolink Desktop Application 1. Overview Name : Reolink Desktop Application Version : 8.18.12 Vendor : Reolink CWE : CWE-1204: Generation of Weak Initialization Vector IV, CWE-321: Use of Hard-coded Cryptographic Key CVSS : 5.1 MEDIUM Vector...

CVE-2026-17324

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function...

CVE-2026-17324

The software IBM API Connect versions 12.1.0.0 through 12.1.1.2 contains multiple vulnerabilities that could allow a remote attacker to perform unauthorized actions and access sensitive configuration data. The root cause is identified as missing authentication for a critical function (CWE-306). N...

EUVD-2026-118715

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function...

EUVD-2026-118671

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a...

CVE-2023-2916

CVE-2023-2916 CVE-2023-2916 PoC The InfiniteWP Client plugin for WordPress, in versions up to and including 1.11.1, is vulnerable to a Sensitive Information Exposure flaw. This vulnerability allows authenticated attackers with subscriber-level permissions or above to extract sensitive data,...

PT-2026-139076

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 12.1.0.0 through 12.1.1.2 Description A critical flaw exists where missing authentication for a critical function allows a remote attacker to access sensitive configuration data and perform unauthorized actions...

CVE-2026-117624

A flaw was found in Jenkins. The application fails to consistently enforce restrictions against deserializing certain object types as nested values when those types are designated only for top-level configuration files. An attacker can exploit this flaw by submitting crafted configuration data to...

opencspm

OpenCSPM Open Cloud Security Posture Management, OpenCSPM, is an open-source platform for gaining deeper insight into your cloud configuration and metadata to help understand and reduce risk over time. Who is OpenCSPM for? Security teams running infrastructure in cloud environments looking to gai...

Exploit for Improper Access Control in Joomla Joomla\!

CVE-2026-35223 – Joomla Improper Access Control 1. Overvie...

EUVD-2026-111152

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request...

WatchGuard Fireware OS input validation error vulnerability

Security vulnerabilities exist in WatchGuard Fireware OS versions from 12.0 up to and including 12.12.4, as well as versions from 2025.1 up to and including 2026.4. These vulnerabilities stem from XPath injection during SSH authentication. Remote unauthenticated attackers capable of accessing the...

PT-2026-126642

An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request...