CVE-2026-111614 DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials

DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate auto-increment ids on the source,...

CVE-2026-111614

DataCap versions through 2025.1.1 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability within the BaseController.getInfoForPath method. This flaw allows authenticated users to access other users' datasources, snippets, and dashboards by providing a numeric ID. A low-privile...

CVE-2026-107617

An attacker can use a hard-coded credential to log in to EseeCloud devices...

CVE-2026-107617 Guangzhou Juan IoT Technology EseeCloud Use of Hard-coded Credentials

An attacker can use a hard-coded credential to log in to EseeCloud devices...

EUVD-2026-102878

An attacker can use a hard-coded credential to log in to EseeCloud devices...

CVE-2026-107617

EseeCloud devices are vulnerable to unauthorized access because an attacker can use hard-coded credentials to log in. This vulnerability, identified as CVE-2026-107617 , stems from the use of hard-coded credentials (CWE-798 ) within the product. The impact includes high consequences for confident...

CVE-2026-56718

CVE-2026-56718 Unauthenticated path traversal in jdbhttpd/0.1.0 AJCloud AJY IPC firmware allowing remote reading of arbitrary files as root, including cleartext RTSP credentials. CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory Severity: CVSS 4.0 - 8.7 High Affected: AJClou...

SUSE-SU-2026:4703-1 Security update for libsoup2

This update for libsoup2 fixes the following issues: - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch bsc1272195. - CVE-2026-15711: SoupWebsocketConnection: WebSocket remote denial of service via oversized control frame protocol...

netgear-telenetenable

telnetenable.py Paul Gebheim Translated from the C source available from http://wiki.openwrt.org/oldwiki/openwrtdocs/hardware/netgear/telnetconsole Running: python telnetenable.py IP - The IP of your Netgear device, usually 192.168.1.1 MAC - The mac address should be the MAC address of the LAN po...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. CVE-2026-12547: Header "Proxy-Authorization" leads to credentials being send to different proxy after proxy switch bsc1272195. CVE-2026-15711:...

SUSE-SU-2026:4690-1 Security update for libsoup

This update for libsoup fixes the following issues: - CVE-2026-12478: websocket: Fix out-of-bounds read when reading unmasked frame bsc1271401. - CVE-2026-12547: Header 'Proxy-Authorization' leads to credentials being send to different proxy after proxy switch bsc1272195. - CVE-2026-15711:...

CVE-2026-75903

The Vulnity Security plugin for WordPress (versions up to and including 1.4.3 ) is vulnerable to an unauthenticated authentication bypass . On Nginx-based installations , the plugin generates a server configuration snippet that protects the incorrect directory path for the delegated-login pairing...

CVE-2026-75903 Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials

The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippe...

CVE-2026-107646

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woofsettingswoofstatserveroptions' parameter. This makes it possible for unauthenticated attackers to extract the...

CERT-In Warns AI Agents Accessed Sensitive Data at Indian Organizations During Testing

AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15. The agents went beyond their assigned tasks, and none of the organizations detected the...

CVE-2026-107646

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.4.5 . The flaw exists in the 'woof_settings[woof_stat][server_options]' parameter, which allows unauthenticated attackers to extract ...

Malicious code in xapi-lib (npm)

[email protected], 88.2.5, 90.2.1, and 90.3.1 describes itself as a package for getting IP location and metadata. Its preinstall hook runs node index.js on npm install and requests https://realwbx.com/ip.php?ip=8.8.8.8 with the hardcoded Authorization value fa79878bc2cfb48bd5127ae26fb661b1, which i...

CVE-2026-109191

The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'imagehubapikeys 6 options' parameter. This makes it possible for authenticated attackers, with...

gladius

Gladius Easy mode from Responder to Credentials Author: Cory Duplantis @ctfhacker / blog Blog post on Gladius asciicast Gladius provides an automated method for cracking credentials from various sources during an engagement. We currently crack hashes from Responder, secretsdump.py, and...

CVE-2026-109191 Image Hub <= 1.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure in Admin Page HTML

The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.0 via the 'imagehubapikeys 6 options' parameter. This makes it possible for authenticated attackers, with...