PT-2026-120839

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowin...

Webasyst Framework 4.0.3 OAuth Credential Interception

Webasyst Framework version 4.0.3 and earlier contains an OAuth 2.0 validation flaw that may allow interception of authorization credentials and access tokens...

PT-2026-120760

Name of the Vulnerable Software and Affected Versions Apache Pulsar Manager versions 0.1.0 through 0.4.0 Description Apache Pulsar Manager contains several security flaws. The process for creating the initial administrator account is accessible without authentication and remains available after...

PT-2026-120483

The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created...

RHEL 8 : php:7.4 (RHSA-2026:87080)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:87080 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: php: Out-of-bounds read via empt...

spark-jdbc-serde-url

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-jdbc-serde-url spark-jdbc-serde-url Class: JDBC URL injection Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation SPARK-31710 stopped scan-time extra options from overriding a stored JDBC url...

CVE-2026-81212

IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters...

CVE-2026-81212

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to an improper authorization flaw (CWE-285) that allows an unauthenticated user to perform an arbitrary write into the shared Redis instance. This vulnerability allows an anonymous caller to write data under any tenant's key, effectively c...

CVE-2026-92559

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 are vulnerable to a credential exposure due to binding to an unrestricted IP address (CWE-1327). This flaw could allow a remote attacker to obtain sensitive information. To remediate this vulnerability, IBM recommends applying the fix ...

CVE-2026-26744

CVE-2026-26744 A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames e.g., "The username you've inserted doesn't exist. Plea...

Cleartext-Storage-vulnerability-CVE-2023-5359-in-W3-Total-Cache

Cleartext-Storage-vulnerability-CVE-2023-5359-in-W3-Total-Cache Targets versions ≤2.7.5 vulnerable to CVE-2023-5359 import requests import re from urllib.parse import urljoin Common paths where credentials are stored CREDENTIALPATHS =...

A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...

GHSA-4FPJ-G9JF-9RGG A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...

A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

Impact. A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The agent serves an AgentCard with an APIKeySecurityScheme specifying a custom header name, then responds with an HTTP redirect. The JDK HttpClient follows th...

GHSA-9RHM-2H4X-JWMX A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

Impact. A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrary third-party server. The agent serves an AgentCard with an APIKeySecurityScheme specifying a custom header name, then responds with an HTTP redirect. The JDK HttpClient follows th...

POC-CVE-2022-26671

If you got here, you know why this repo needed created. CVE-2022-26671 GET /AT/ATDefault.aspx Line's 430 contains the cleartext credential. secom | supervisor In regards to to responsible disclosure, not dislcosing a hardcoded cleartext HTTP body response is silly when its the login page./...

CVE-2026-86413

When using an ambient user in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there...

CVE-2026-87861

When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused...

EUVD-2026-105306

An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...

CVE-2026-86414

libcurl is vulnerable to a credential leak where an HTTP proxy can trick the library into sending the origin's credentials (such as Basic password or Negotiate/Kerberos tickets ) to the proxy itself. This occurs because the proxy can respond to a CONNECT tunnel request with a 401 WWW-Authenticate...