CVE-2026-114509 Laravel TokenGuard authentication bypass through non-string API credentials

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowin...

CVE-2026-114137

A flaw was found in Django REST Framework. When an application attempts to revoke authentication credentials using the TokenProxy component, the deletion query targets an incorrect identifier, causing the deletion to silently fail without raising an error. Consequently, revoked credentials remain...

CVE-2026-112408

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

EUVD-2026-107541

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

CVE-2026-112408

The Amazon SageMaker Python SDK is vulnerable to a flaw in the default_bucket() function, where the SDK fails to verify the ownership of S3 buckets. Specifically, versions V3 before 3.10.0 and V2 before 2.257.3 do not validate the source of the communication channel, allowing a remote actor to ac...

CVE-2026-112408 Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

CVE-2026-112408

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

CVE-2026-112408 Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

CVE-2026-111812

The origin_server_auth plugin in Apache Traffic Server contains a vulnerability allowing a client to force the signing of attacker-chosen AWS request headers using the proxy's own IAM credentials . This issue impacts versions 8.0.0 through 8.1.11 , 9.0.0 through 9.2.15 , 10.0.0 through 10.1.4 , a...

CVE-2026-111812 Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials

Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are...

CVE-2026-53986

Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...

CVE-2026-53986 Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure

Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...

EUVD-2026-107366

Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...

CVE-2026-53986

The Girafit camera app (Android and iOS) version 1.9.1 and earlier , along with Girafit camera devices , are affected by a hardcoded credentials vulnerability. Attackers can obtain a shared TURN relay username by decompiling the application or intercepting unencrypted network traffic during live ...

CVE-2026-114471

Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local user who can read the server's log, or anyone given a copy of it, to obtain credentials. With SMTP logging enabled, the server hid the credential of an AUTH...

CVE-2026-114471 Insertion of Sensitive Information into Log File in hMailServer

Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local user who can read the server's log, or anyone given a copy of it, to obtain credentials. With SMTP logging enabled, the server hid the credential of an AUTH...

EUVD-2026-107314

Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local user who can read the server's log, or anyone given a copy of it, to obtain credentials. With SMTP logging enabled, the server hid the credential of an AUTH...

CVE-2026-114471 Insertion of Sensitive Information into Log File in hMailServer

Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local user who can read the server's log, or anyone given a copy of it, to obtain credentials. With SMTP logging enabled, the server hid the credential of an AUTH...

CVE-2026-114471

Progressive Robot hMailServer versions 6.0.0 through 6.3.6 are vulnerable to an insertion of sensitive information into a log file within the SMTP server. When SMTP logging is enabled, the server fails to mask sensitive data in several SASL exchanges, including AUTH PLAIN passwords (if sent befor...

cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments

A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine VM credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password value...