CVE-2026-71238 DjangoCRM - Hardcoded Django SECRET_KEY Enables Session and CSRF Token Forgery

DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid...

CVE-2026-71238

The CVE-2026-71238 entry affects DjangoCRM where a hardcoded Django SECRET_KEY is stored in webcrm/settings.py instead of reading from the environment. This secret key is used for session signing, CSRF token generation, and password reset tokens, allowing anyone with access to the public reposito...

EUVD-2026-53311

DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid...

CVE-2026-71238

DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid...

EUVD-2026-53292

The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive data in the feedback.db database across tables, including user accounts, phone numbers, feedback content, and local debug log paths, thereby enabling the thef...

CVE-2026-67196

Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...

CVE-2026-61515

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit...

CLSA-2026-1784682965 TuxCare security update for debug (3 CVEs)

TuxCare rebuilt debug to address 3 CVEs. Fixed in 1.0.4-tuxcare.1...

CLSA-2026-1784596327 TuxCare security update for debug (4 CVEs)

TuxCare rebuilt debug to address 4 CVEs. Fixed in 2.1.0-tuxcare.1...

CLSA-2026-1776904644 TuxCare security update for debug (5 CVEs)

TuxCare rebuilt debug to address 5 CVEs. Fixed in 3.1.0-tuxcare.1...

CLSA-2026-1776904643 TuxCare security update for debug (11 CVEs)

TuxCare rebuilt debug to address 11 CVEs. Fixed in 3.2.7-tuxcare.1...

CLSA-2026-1774225219 TuxCare security update for debug (6 CVEs)

TuxCare rebuilt debug to address 6 CVEs. Fixed in 2.2.0-tuxcare.1...

CLSA-2026-1773101693 TuxCare security update for debug (7 CVEs)

TuxCare rebuilt debug to address 7 CVEs. Fixed in 2.1.1-tuxcare.2...

CLSA-2026-1773101692 TuxCare security update for debug (4 CVEs)

TuxCare rebuilt debug to address 4 CVEs. Fixed in 2.3.3-tuxcare.2...

CLSA-2026-1772928825 TuxCare security update for debug (6 CVEs)

TuxCare rebuilt debug to address 6 CVEs. Fixed in 2.3.3-tuxcare.1...

EUVD-2026-52693

Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...

CVE-2026-67196 Perspective 5.0.0 XSS via Debug Plugin innerHTML Interpolation

Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...

CVE-2026-67196 Perspective 5.0.0 XSS via Debug Plugin innerHTML Interpolation

Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...

CVE-2026-67196

Vulnerability : In Perspective 5.0.0, the built-in Debug plugin is vulnerable to cross-site scripting via innerHTML interpolation during CSV serialization. Trigger : attackers craft table rows whose cells contain unescaped HTML markup, including unquoted event-handler attributes, which are not es...

CVE-2026-11836 Production Debug-Unlock Token Verification Missing Device Binding

Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware validatedebugunlocktoken in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued fo...