CVE-2026-58475

Sustainable Irrigation Platform SIP through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the...

CVE-2026-15075

In Eclipse Vert.x versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, DefaultRedirectHandler vertx-core propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison scheme, host, port is performed before copyin...

CVE-2026-15075

CVE-2026-15075 affects Eclipse Vert.x up to 4.5.29 (4.x) and 5.1.4 (5.x). The DefaultRedirectHandler in vertx-core forwards all request headers across cross-origin HTTP 30x redirects, stripping only Content-Length. No origin check is performed before copying headers to the redirect target. This a...

Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

Summary The official Kimai Docker image ships with APPSECRET=changethistosomethingunique as the default environment variable. The Docker entrypoint does not override or validate this value. Any Kimai instance deployed using the Docker image without explicitly setting APPSECRET runs with a...

GHSA-JR9P-4H4J-6C58 Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

Summary The official Kimai Docker image ships with APPSECRET=changethistosomethingunique as the default environment variable. The Docker entrypoint does not override or validate this value. Any Kimai instance deployed using the Docker image without explicitly setting APPSECRET runs with a...

Insecure Default Initialization of Resource

Overview Affected versions of this package are vulnerable to Insecure Default Initialization of Resource through the use of a default APPSECRET value in the Docker deployment process. An attacker can gain unauthorized access to any user account, including administrative accounts, by forging...

PT-2026-60107

Name of the Vulnerable Software and Affected Versions n8n-mcp versions prior to 2.57.4 Description In multi-tenant HTTP mode, an authenticated tenant can access local default-scope workflow versions backups instead of being restricted to their own tenant scope. This issue allows an authenticated...

SIP Sustainable Irrigation Platform 5.x Stored XSS

Summary SIP is a free Raspberry Pi based Python program for controlling irrigation systems sprinkler, drip, hydroponic, etc. It uses web technology to provide an intuitive user interface UI in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile device...

SIP Sustainable Irrigation Platform 5.x (cli_control) Remote Code Execution

Summary SIP is a free Raspberry Pi based Python program for controlling irrigation systems sprinkler, drip, hydroponic, etc. It uses web technology to provide an intuitive user interface UI in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile device...

SIP Sustainable Irrigation Platform 5.x (nr-url) Blind SSRF

Summary SIP is a free Raspberry Pi based Python program for controlling irrigation systems sprinkler, drip, hydroponic, etc. It uses web technology to provide an intuitive user interface UI in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile device...

SIP Sustainable Irrigation Platform 5.x Path Traversal in Backup/Restore

Summary SIP is a free Raspberry Pi based Python program for controlling irrigation systems sprinkler, drip, hydroponic, etc. It uses web technology to provide an intuitive user interface UI in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile device...

SIP Sustainable Irrigation Platform 5.x (cv) Settings Mass Assignment

Summary SIP is a free Raspberry Pi based Python program for controlling irrigation systems sprinkler, drip, hydroponic, etc. It uses web technology to provide an intuitive user interface UI in several languages. The UI can be accessed in your favorite browser on desktop, laptop, and mobile device...

PT-2026-58036

Name of the Vulnerable Software and Affected Versions Zephyr OS versions 3.7.0 through 4.4.0 Description On Xtensa SoCs configured with CONFIG XTENSA MPU and CONFIG USERSPACE, the arch buffer validate function in arch/xtensa/core/mpu.c incorrectly permits access to memory when a buffer's rounded...

CVE-2026-5269: Use of Default Password

In Ciena's Navigator Network Control Suite NCS and Manage Control Plan MCP, there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker...

CVE-2026-44761: Use of Default Credentials

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token...

📄 SIP Sustainable Irrigation Platform 5.x Remote Code Execution

SIP Sustainable Irrigation Platform version 5.x executes user-configured operating-system commands when an irrigation station changes state, if the optional clicontrol plugin is installed and enabled. This can be exploited to run arbitrary commands on the affected host by storing a command throug...

PT-2026-58864

In Ciena's Navigator Network Control Suite NCS and Manage Control Plan MCP, there are hidden system accounts used for internal software operations. Some of these accounts have default passwords that may be predictable. While these accounts have very limited permissions on their own, an attacker...

PT-2026-58933

Summary In multi-tenant HTTP mode ENABLE MULTI TENANT=true, an authenticated tenant could, under certain conditions, reach n8n-mcp's local default-scope workflow versions backups instead of being confined to its own tenant scope. This affects n8n-mcp's own local workflow-version storage, not a...

PT-2026-58969

Summary The official Kimai Docker image ships with APP SECRET=change this to something unique as the default environment variable. The Docker entrypoint does not override or validate this value. Any Kimai instance deployed using the Docker image without explicitly setting APP SECRET runs with a...

PT-2026-58030

Sustainable Irrigation Platform SIP through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the...