7304 matches found
CVE-2026-28256
A CVE-2026-28256 entry describes a Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge. Affected components are Trane Tracer SC and related products; root cause is hard-coded security constants that could enable an attacker to disclose...
CVE-2026-28255 Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts...
CVE-2026-28255 Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge
A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts...
CVE-2026-28255
CVE-2026-28255 affects Trane Tracer SC, Tracer SC+, and Tracer Concierge. A Use of Hard-Coded Credentials vulnerability could allow an attacker to disclose sensitive information and take over accounts. The connected documents consistently identify the issue as hard-coded credentials without provi...
Trane Tracer SC, Tracer SC+, and Tracer Concierge
RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, execute arbitrary commands, or perform a denial-of-service on the product. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...
CVE-2025-15038
The CVE-2025-15038 affected component is the ASUS Business System Control Interface driver. A vulnerability described as Out-of-Bounds allows a local, unprivileged user to craft an IOCTL request that can trigger kernel information disclosure or cause a system crash. The exposure is linked to loca...
CVE-2025-15038
An Out-of-Bounds Read vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by a unprivileged local user sending a specially crafted IOCTL request, potentially leading to a disclosure of kernel information or a system crash. Refer to the...
WordPress RegistrationMagic plugin <= 6.0.7.2 - Subscriber+ Sensitive Data Disclosure vulnerability
Subscriber+ Sensitive Data Disclosure vulnerability discovered by bRpsd in WordPress Plugin RegistrationMagic versions = 6.0.7.2...
PT-2026-25028
A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts...
The vulnerability of the crypto/modes/ocb128.c component of the OpenSSL library for TLS and SSL protocols allows attackers to access confidential data and compromise its integrity.
The vulnerability of the crypto/modes/ocb128.c component of the TLS and SSL OpenSSL protocol is related to the absence of a necessary encryption step. Exploiting this vulnerability can allow attackers to gain access to confidential data and compromise its integrity...
CVE-2025-62328
HCL Nomad server on Domino did not configure the frame-ancestors directive in the Content-Security-Policy header by default which could allow an attacker to obtain sensitive information via unspecified vectors...
Shopware: Unauthenticated data extraction possible through store-api.order endpoint
Summary An insufficient check on the filter types for unauthenticated customers allows access to orders of other customers. This is part of the deepLinkCode support on the store-api.order endpoint. Details Data Exposure Depending on the order payload configuration, attackers may retrieve: -...
CVE-2026-21791
HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL...
USN-8081-1: libpng vulnerabilities
It was discovered that libpng did not properly handle memory when processing certain PNG files. An attacker could possibly use this issue to cause libpng to crash, resulting in a denial of service, or disclose sensitive information. CVE-2025-64505 Joshua Inscoe discovered that libpng did not...
EUVD-2026-11108
A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized...
CVE-2026-21289
CVE-2026-21289 affects Adobe Commerce components across versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier, introducing an Incorrect Authorization vulnerability that could bypass security features and allow an attacker to view data without user interaction. Pub...
PT-2026-24589
Name of the Vulnerable Software and Affected Versions Koha affected versions not specified Description An authenticated SQL Injection issue exists in the Koha staff interface. The issue is located in the /cgi-bin/koha/suggestion/suggestion.pl endpoint, specifically due to insufficient validation ...
CVE-2025-22850
The CVE-2025-22850 issue is a Time-of-checkTime-of-use race in the UEFI PdaSmm module on certain Intel reference platforms that may allow information disclosure. A system software adversary with privileged user access and a high-complexity/local-attack could expose data without user interaction. ...
EUVD-2026-10833
The register protection of the PowerVR GPU is incorrectly configured. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...