CVE-2026-63106

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...

CVE-2026-63106 ReadyEcommerce < 4.5.2 Unauthenticated SQL Injection via ProductController.php

ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API where the rating parameter from the products endpoint is concatenated directly into a MySQL HAVING clause without parameterization in ProductController.php. Attackers can perform...

CVE-2026-6374

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026...

CVE-2026-19429

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-12984

Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026...

CVE-2026-12984

Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026...

EUVD-2026-55622

Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026...

CVE-2026-12984

CVE-2026-12984 concerns Zyxel Networks WAH7601 (affected through 20072026). The vulnerability is described as Insufficiently Protected Credentials that allows retrieval of embedded sensitive data. Connected documents confirm the affected product and the core impact, but do not provide detailed ro...

EUVD-2026-55619

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026...

CVE-2026-6374 Hardcoded Credentials in Zyxel WAH7601 Router

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026...

CVE-2026-6374 Hardcoded Credentials in Zyxel WAH7601 Router

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026...

CVE-2026-6374

The vulnerability CVE-2026-6374 affects Zyxel Networks WAH7601 routers (through 20.07.2026). The issue is a Hardcoded Credentials flaw that enables reading sensitive constants within an executable. CVSS 3.1 base score 7.3 (HIGH) with Attack Vector Adjacent, Attack Complexity Low, Privileges Requi...

CVE-2026-19429

Jenkins FilePath.untarFrom does not validate symlink targets when extracting TAR archives, allowing an attacker with Item/Configure permission to create symlinks from a workspace to arbitrary files on the Jenkins controller. This issue remains exploitable in versions patched for CVE-2026-33001 an...

CVE-2026-19429

...

Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials

Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code VS Code extension named Solidity Pro "solidity-pro" that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-p...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: nfsd: Fixed a cred reference leak in nfsdnlthreadssetdoit. syzbot reported a memory leak of the struct cred. 0 nfsdnlthreadssetdoit passes getcurrentcred to nfsdsvc, but putcred is not called afterward. The cred is finally...

Astra Linux – Vulnerability in qBittTorrent

All versions of the qBittorrent client up to 4.5.5 use default credentials when the web user interface is enabled. Administrators are not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and...

nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs,...

PT-2026-69956

Name of the Vulnerable Software and Affected Versions Data Science Pipelines Operator affected versions not specified Description A flaw exists where the operator uses a cryptographically weak pseudo-random number generator PRNG—a mathematical algorithm used to generate sequences of numbers that...

EUVD-2026-54948

A flaw has been found in NocteDefensor LudusMCP up to 1.0.24. Affected is an unknown function of the file src/tools/insertCredsRangeConfig.ts of the component insertcredsrangeconfig. Executing a manipulation of the argument configPath/outputPath can lead to path traversal. The attack is restricte...