CVE-2026-114137

A flaw was found in Django REST Framework. When an application attempts to revoke authentication credentials using the TokenProxy component, the deletion query targets an incorrect identifier, causing the deletion to silently fail without raising an error. Consequently, revoked credentials remain...

CVE-2026-112408

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

CVE-2026-112408 Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

CVE-2026-112408

The Amazon SageMaker Python SDK is vulnerable to a flaw in the default_bucket() function, where the SDK fails to verify the ownership of S3 buckets. Specifically, versions V3 before 3.10.0 and V2 before 2.257.3 do not validate the source of the communication channel, allowing a remote actor to ac...

EUVD-2026-107541

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

CVE-2026-112408 Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

CVE-2026-112408

Missing verification of source of a communication channel in the defaultbucket function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creati...

CVE-2026-111812 Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials

Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are...

CVE-2026-111812

The origin_server_auth plugin in Apache Traffic Server contains a vulnerability allowing a client to force the signing of attacker-chosen AWS request headers using the proxy's own IAM credentials . This issue impacts versions 8.0.0 through 8.1.11 , 9.0.0 through 9.2.15 , 10.0.0 through 10.1.4 , a...

CVE-2026-111812 Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials

Apache Traffic Server's originserverauth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are...

CVE-2026-53986

Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...

CVE-2026-53986 Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure

Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...

CVE-2026-53986

The Girafit camera app (Android and iOS) version 1.9.1 and earlier , along with Girafit camera devices , are affected by a hardcoded credentials vulnerability. Attackers can obtain a shared TURN relay username by decompiling the application or intercepting unencrypted network traffic during live ...

EUVD-2026-107366

Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...

CVE-2026-53986 Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure

Girafit camera app Android and iOS version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration...

Arrakis Security Report Finds 76% of AI Agents Are Dormant but Keep Their Credentials and Connections

New York, NY, USA, 21st October 2026, CyberNewswire...

CVE-2026-114471

Insertion of sensitive information into a log file in the SMTP server of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a local user who can read the server's log, or anyone given a copy of it, to obtain credentials. With SMTP logging enabled, the server hid the credential of an AUTH...

Drupal SAML SSO – Service Provider trust management issue vulnerability

Drupal SAML SSO – Versions 0.0.0 through 3.2.0 contain a trust management vulnerability caused by the use of hard-coded credentials. This may lead to the retrieval of sensitive embedded data...

Berri AI LiteLLM permission and access control vulnerability

A security vulnerability exists in Berri AI LiteLLM versions from 1.87.0 up to and including 1.100.4, from 1.101.0 up to and including 1.101.3, from 1.102.0 up to and including 1.102.2, from 1.103.0 up to and including 1.103.1, and from 1.104.0-rc.1 up to and including 1.104.0-rc.2. This...

Drupal Mailer Plus Log log information leakage vulnerability

In Drupal Mailer Plus versions 0.0.0 through 1.2.7, there is a vulnerability related to log information leakage. This occurs when sensitive data is inserted into log files, potentially allowing remote services possessing stolen credentials to exploit this flaw...