74235 matches found
EUVD-2026-94675
The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the application...
CVE-2026-92861
The Android application "Ticket Ryutsu Center" contains hard-coded credentials, which may allow an attacker to obtain an API key used by the application...
CLEANSTART-2026-GO41173 Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly
Security vulnerability affects the apache-hive package. Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly...
CLEANSTART-2026-AY37213 Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces
Security vulnerability affects the apache-nifi-registry package. Spring Security's embedded UnboundID LDAP server UnboundIdContainer unconditionally registers an administrative credential and binds its listener to all available network interfaces...
CLEANSTART-2026-GT11567 In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials
Security vulnerability affects the elasticsearch package. In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials...
Not Failing Securely ('Failing Open')
Overview org.postgresql:postgresql is a Java JDBC 4.2 JRE 8+ driver for PostgreSQL database. Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' via the requireAuth property when it is configured to exclude all authentication methods or is left empty. An attack...
PT-2026-108220
Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description The local management interface in certain configurations is susceptible to cross-site scripting XSS, a technique wher...
CVE-2026-71183: Incorrect Authorization
An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls...
CVE-2026-84891: Use of Hard-coded Credentials
IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials...
CVE-2026-71895: Missing Authorization
An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the...
CVE-2026-84250: Use of Hard-coded Credentials
IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component. A local attacker could exploit this vulnerability to recover the root password and gain root privileges...
CVE-2026-87672: Insertion of Sensitive Information into Log File
An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support...
SUSE SLED15 / SLES15 Security Update : libsoup (SUSE-SU-2026:4558-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4558-1 advisory. - CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. - CVE-2026-12547:...
CVE-2026-11936: Improper Neutralization of Input During Web Page Generation
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus...
PT-2026-108239
Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 Description An issue exists where an authenticated user can embed arbitrary JavaScript code in the Web UI. This cross-site...
PT-2026-108001
Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22 IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 IBM DataPower Gateway versions 10.6.1 through 10.6.6 IBM DataPower Gateway versions 11.0.0.0 through 11.0.0.2 Description An...
PT-2026-108034
Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.56.0 through 1.107.5 Pydantic AI versions prior to 2.44.0 Description Applications that enable local network access for attacker-influenced URLs via FileUrl with force download='allow-local' or web fetch tool with allow...
CVE-2026-17189: Improper Neutralization of Input During Web Page Generation
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leadin...
CVE-2026-107289: Server-Side Request Forgery (SSRF)
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, applications that opt attacker-influenced URLs into local network access through FileUrl with forcedownload='allow-local' or webfetchtool with...