CVE-2023-23752

CVE-2023-23752 - Recurrence of Joomla Unauthorized Access Vulnerability Script Usage Install python libraries pip install -r requirements.txt Vulnerability Verification python3 CVE-2022-26134check.py -u url -c whoami Batch Scan python3 CVE-2023-23752.py -f urlpart.txt Affected Versions 4.0.0 =...

CVE-2026-110243

The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-78356

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application...

CVE-2026-74047

Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth...

CVE-2026-74047 Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint

Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth...

CVE-2026-74047

Wazuh versions 4.0.0 before 4.14.8 are susceptible to an information disclosure vulnerability. Low-privileged users with agent:read permissions (specifically the default readonly role) can access the unmasked agent configuration endpoint. By requesting the auth component configuration for pseudo-...

CVE-2026-74047 Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint

Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth...

CVE-2026-74047: Exposure of Sensitive Information to an Unauthorized Actor

Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth...

CVE-2026-78356

The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend rout...

UBUNTU-CVE-2026-78356

The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend rout...

CVE-2026-78356

The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend rout...

EUVD-2026-97266

The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information may include configured frontend rout...

PT-2026-110488

Name of the Vulnerable Software and Affected Versions OTRS versions 8.0.X OTRS versions 2023.X OTRS versions 2024.X OTRS versions 2025.X OTRS versions prior to 2026.7.X Description The Agent Frontend configuration endpoint can be accessed without authentication, allowing remote users to retrieve...

CLEANSTART-2026-YL24808 flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management

Security vulnerability affects the keycloak package. A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management...

CVE-2026-38058

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them...

PT-2026-89880

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them...

CVE-2026-50165 alf.io has Improper Access Control for Organization Owners that Exposes System Secrets

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuratio...

EUVD-2026-57453

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers...

GHSA-34FJ-MWM6-FJFG SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

CVE: This vulnerability corresponds to CVE-2026-72794. Summary /api/system/getConf returns Conf.CookieKey, the key used to sign the server's session cookies in its response body. The endpoint is registered with CheckAuth only, so the field reaches the publish RoleReader token and the anonymous...

CVE-2026-52111: Improper Access Control

An issue in fast-note-sync-service =2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey...