Security Bulletin: IBM Storage Protect Client and Virtual Environments are affected by weaker than expected security in IBM WebSphere Application Server Liberty (CVE-2025-14917)

Summary IBM Storage Protect Client and Virtual Environments use IBM WebSphere Application Server Liberty as part of its web application runtime. A vulnerability in IBM WebSphere Application Server Liberty could provide weaker than expected security when administering security settings. IBM Storag...

CVE-2026-16503

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

CVE-2026-16504

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password "zulip", and DISABLEHTTPS=True...

CVE-2026-16504 VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password "zulip", and DISABLEHTTPS=True...

EUVD-2026-51547

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

CVE-2026-16503

The VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432 ) using the default password "postgres" . Because Docker manages its own iptables rules, this configuration bypasses standard host UFW firewall protections. A remote attacker ca...

CVE-2026-16503 VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

CVE-2026-16503 VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

PT-2026-66762

Name of the Vulnerable Software and Affected Versions VPS.org one-click Supabase template affected versions not specified Description Deployment of the template installs a PostgreSQL instance published on all interfaces 0.0.0.0:5432 using a default database password set to postgres. This exposure...

PT-2026-66763

Name of the Vulnerable Software and Affected Versions Zulip affected versions not specified Description The VPS.org one-click Zulip template deployment contains security misconfigurations, including a hardcoded application signing key and a default database password set to zulip. Additionally, th...

CVE-2026-16504: Use of Hard-coded Cryptographic Key

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password "zulip", and DISABLEHTTPS=True...

CVE-2026-55579

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...

CVE-2026-55579 Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...

CVE-2026-55579

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...

EUVD-2026-49387

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin SHA-512 hash stored at pheditor.php:11. There is no mechanism to force a password change on first login. Any deployment using the...

GHSA-F25V-X6VR-962G Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

Summary The forced password-change flow, triggered when the stored password is still the default admin, does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditorpassword is enough to reach the password-change form, and...

Authentication Bypass by Assumed-Immutable Data

Overview Affected versions of this package are vulnerable to Authentication Bypass by Assumed-Immutable Data in the password change process when the stored password remains at its default value and the submitted password is not verified. An attacker can gain unauthorized access and set a new...

EUVD-2026-48436

9router 0.4.59 fixed in 0.4.60 contains a chain of vulnerabilities: a hardcoded default password 123456 that authenticates any fresh installation, a bypass of the LOCALONLY network gate via a spoofed Host header, and unvalidated arguments passed to childprocess.spawn when registering MCP plugins....

CVE-2026-63732

9router 0.4.59 fixed in 0.4.60 contains a chain of vulnerabilities: a hardcoded default password 123456 that authenticates any fresh installation, a bypass of the LOCALONLY network gate via a spoofed Host header, and unvalidated arguments passed to childprocess.spawn when registering MCP plugins....

CVE-2026-63732 9router before 0.4.60 Remote Code Execution via default password

9router 0.4.59 fixed in 0.4.60 contains a chain of vulnerabilities: a hardcoded default password 123456 that authenticates any fresh installation, a bypass of the LOCALONLY network gate via a spoofed Host header, and unvalidated arguments passed to childprocess.spawn when registering MCP plugins....