Homarr < 1.54.0 - Information Disclosure

Homarr 1.54.0 contains an information disclosure caused by the integration.all tRPC endpoint being exposed as a publicProcedure, letting unauthenticated users retrieve sensitive integration metadata, exploit requires no authentication. id: CVE-2026-27796 info: name: Homarr 1.54.0 - Information...

Automad < 2.0.0-beta.28 - Unauthenticated Admin Password Hash Disclosure

Automad 2.0.0-alpha.1 to 2.0.0-beta.27 contains a broken access control vulnerability caused by publicly accessible /api/user-collection/create-first-user endpoint returning full serialized user data, letting unauthenticated attackers retrieve bcrypt password hashes of all administrator accounts,...

Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion

Joomla! Jtag Members Directory 5.3.7 is vulnerable to local file inclusion via the downloadfile parameter. id: CVE-2018-6008 info: name: Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion author: daffainfo severity: high description: Joomla! Jtag Members Directory 5.3.7 is vulnerable to...

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-87)

Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet...

CVE-2026-59503

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor...

CVE-2026-59499

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor...

EUVD-2026-57774

CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control...

CVE-2026-59507

Technical details about CVE-2026-59507 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-59503

CVE-2026-59503 describes exposure of sensitive information to an unauthorized actor with a CVSS v3.1 base score of 9.1 (CRITICAL). The attack vector is NETWORK with no privileges required and no user interaction, and it impacts confidentiality and integrity (both HIGH) while availability remains ...

CVE-2026-59503 Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor...

CVE-2026-59503

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor...

EUVD-2026-57770

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor...

EUVD-2026-57760

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor...

CVE-2026-59499

Technical details about CVE-2026-59499 are not publicly available in the provided documents. No affected products, root cause, or remediation are disclosed here. Monitor for updates from official sources.

CVE-2026-59499 Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor...

CVE-2026-59499

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor...

PT-2026-71409

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor...

CVE-2026-65017

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-65017

CVE-2026-65017 describes a masking bypass in Apache Airflow’s Config API in multi-team deployments. A Viewer with only configuration-read access could read a team-scoped Celery broker URL and its embedded credentials in cleartext, even though the global option is masked. The issue arises because ...

CVE-2026-65017 Apache Airflow: Config API: team-scoped Celery broker secret disclosed to a Viewer (multi-team masking bypass)

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...