PT-2026-115393

Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read...

PT-2026-115486

Name of the Vulnerable Software and Affected Versions HUSKY – Products Filter for WooCommerce Professional versions prior to 1.4.6 Description An issue exists that allows unauthenticated attackers to extract sensitive database credentials, including the external MySQL host, database name, usernam...

PT-2026-116092

🚨 CVE-2026-111693 DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtai...

PT-2026-116094

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable,...

PT-2026-115614

Name of the Vulnerable Software and Affected Versions EseeCloud affected versions not specified Description An attacker can gain unauthorized access to EseeCloud devices by utilizing a hard-coded credential to log in. Recommendations At the moment, there is no information about a newer version th...

CVE-2026-104715

A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System CIFS share using a user-controlled credentials file, input values are not properly sanitized before being assembled into moun...

PT-2026-115483

Name of the Vulnerable Software and Affected Versions cifs-utils affected versions not specified Description A flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet File System CIFS share using a user-controlled credentials file...

Linux Distros Unpatched Vulnerability : CVE-2026-77711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Jetty's HttpClient make a request to a server through a forward proxy, the server may reply with a 407 Proxy Authentication Required. The client mistakenly...

Linux Distros Unpatched Vulnerability : CVE-2026-104715

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in cifs-utils. This flaw allows an unprivileged local user to achieve privilege escalation. When a privileged service mounts a Common Internet...

CVE-2026-111347

go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP...

CVE-2026-111329

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant...

CVE-2026-111281

Jooan JA-A12 IP cameras with firmware 00920171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen...

Exploit for CVE-2026-104715

CVE-2026-104715 cifs-utils credentials-file option injecti...

CVE-2026-111347 go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd

go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP...

CVE-2026-111347

go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP...

CVE-2026-111347 go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd

go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP...

CVE-2026-111329 JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant...

CVE-2026-111329

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant...

CVE-2026-111329 JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant...

CVE-2026-111329 JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant...