CVE-2026-109758

Perforce Helix Authentication Service HAS deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installe...

CVE-2026-109758: Improperly Controlled Modification of Object Prototype Attributes

Perforce Helix Authentication Service HAS deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In affected versions of HAS, the installation templates contain a default credential which the installe...

CVE-2026-103577: Insecure Default Variable Initialization

Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-72895: Use of Default Cryptographic Key

A vulnerability has been identified in SIMATIC IPC BX-21A All versions V31.01.13, SIMATIC IPC RW-543A All versions V1.1.4, SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G All versions V28.01.15. A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a...

PT-2026-111738

Name of the Vulnerable Software and Affected Versions dataclasses-avroschema versions 0.47.3 through 0.70.5 Description The FieldRepresentation.get field default function inserts a schema-controlled referenced record name into the callable position of a generated default factory lambda without...

CVE-2026-108809

A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-108809 Eleveo Call Recording Software logout session expiration

A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-108808 Eleveo Call Recording Software JWT Token logout get request method with sensitive query strings

A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument idtokenhint can lead to use of get...

CVE-2026-108783

A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2026-108783

A security vulnerability exists in PRVTPRO Amnezia-Web-Panel versions up to 1.6.2/1.7.2 . The flaw is located within the Backup Download component, specifically affecting an unspecified part of the app.py file. This issue allows for the use of default credentials , which can be exploited via a re...

EUVD-2026-97137

A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2026-108783 PRVTPRO Amnezia-Web-Panel Backup Download app.py default credentials

A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed...

PT-2026-110482

Name of the Vulnerable Software and Affected Versions Eleveo Call Recording Software versions prior to 10.3.1 Description An issue exists in the JWT Token Handler component within the file /auth/realms/default/protocol/openid-connect/logout. A remote attacker can manipulate the id token hint...

CVE-2026-108809: Insufficient Session Expiration

A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-108783: Use of Default Credentials

A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py of the component Backup Download. The manipulation leads to use of default credentials. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2026-103658: Heap-based Buffer Overflow

GNU Aspell 0.60.8.2 first vulnerable version is not known contains a heap-based buffer overflow write CWE-122 in its read-only dictionary loader. String::reserve in common/string.hpp computes its capacity check with a signed int ints + 1, so a requested size of 0x7FFFFFFF wraps negative and the...

PT-2026-110410

Name of the Vulnerable Software and Affected Versions PRVTPRO Amnezia-Web-Panel versions prior to 1.6.3 PRVTPRO Amnezia-Web-Panel versions prior to 1.7.3 Description A remote attack is possible in the Backup Download component within the app.py file. This issue allows the use of default credentia...

fwknop

fwknop - Autorización de Paquete Único Introducción fwknop implementa un esquema de autorización conocido como Autorización de Paquete Único SPA, por sus siglas en inglés para un fuerte ocultamiento de servicios. SPA requiere solo un único paquete que está cifrado, no reproducible y autenticado...

brutespray

Brutespray Creado por: Shane Young/@x90sky && Jacob Robles/@shellfail Inspirado por: Leon Johnson/@sho-luv Descripción Brutespray intenta automáticamente credenciales por defecto en los servicios descubiertos. Toma la salida de escaneo de Nmap GNMAP/XML, Nessus, Nexpose, JSON y listas, y luego...

EUVD-2026-96925

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API key...