CVE-2026-94239: Improper Neutralization of Input During Web Page Generation

The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as...

PT-2026-96215

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0 Description An issue exists where PluginSettingList, PluginAllSettingList, and PluginSettingDetail use GlobalSettingsPermissions without the IsAuthenticated permission. Because GlobalSettingsPermissions allows...

CVE-2026-92804 Nango through 0.70.4 Server-Side Request Forgery via Configuration

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potential...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the REST API. An attacker can access confidential configuration values from other realms by leveraging administrative entitlements in one realm to read connector configurations scoped to another realm...

CVE-2026-89066 OS command injection in the task synthesis component in projen

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project...

CVE-2026-81904: Missing Authorization

Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area without checking whether the requesting user could view that sub-block. An unauthenticated visitor could recover configuration values emitted by a restricted sub-block's asset registration —...

PT-2026-88516

Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area without checking whether the requesting user could view that sub-block. An unauthenticated visitor could recover configuration values emitted by a restricted sub-block's asset registration —...

CVE-2024-58375

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...

CVE-2026-19628

A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered...

PT-2026-72056

Name of the Vulnerable Software and Affected Versions Tenable Security Center affected versions not specified Description A command injection flaw allows an authenticated administrator to execute arbitrary commands on the underlying operating system. This occurs when the administrator modifies...

CVE-2026-64800

In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default...

CVE-2026-64800

CVE-2026-64800 : In JetBrains GoLand before 2026.2, sensitive configuration values are written to log files by default, exposing potentially sensitive data. The connected sources confirm the affected product/version and the root cause (logging of sensitive values). No exploitation, mitigation ste...

CVE-2026-64800

In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default...

EUVD-2026-48226

In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default...

PT-2026-63955

In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default...

GoLand -- Multiple vulnerabilities

https://www.jetbrains.com/privacy-security/issues-fixed/ reports: In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default...

CVE-2026-61433 PraisonAI before 4.6.78 Code Injection via API deployment generator

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agentsfile configuration parameters that execute when the generated server starts or...

Umbraco.AI discloses sensitive application configuration values

Impact Under certain configurations, a user with elevated privileges may be able to cause sensitive application configuration values, potentially including secret material such as credentials, to be disclosed. Successful exploitation could expose confidential information and, depending on what th...

PT-2026-64454

Impact Under certain configurations, a user with elevated privileges may be able to cause sensitive application configuration values, potentially including secret material such as credentials, to be disclosed. Successful exploitation could expose confidential information and, depending on what th...

PT-2026-60060

Name of the Vulnerable Software and Affected Versions Apollo Portal versions prior to 2.5.0 Description Apollo Portal fails to verify application and namespace permissions when an authenticated user requests a release by ID. This occurs when configView.memberOnly.envs is enabled and a request is...