69594 matches found
EUVD-2026-74176
The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the...
cve-2026-23744
CVE-2026-23744 – MCPJam Inspector Unauthenticated Remote Code Execution RCE Description Product : MCPJam Inspector Affected versions : ≤ 1.4.2 Fixed version : 1.4.3 Type : Unauthenticated Remote Code Execution RCE Attack vector : Network Authentication required : No User interaction required : No...
CVE-2026-86464
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager IdM deployment included insecure default configurations and credentials for security-sensitive services. The Helm chart exposed the Keycloak service and its PostgreSQL...
CVE-2026-86464
Eclipse aeriOS Identity Manager (IdM) — in its current development version (no official release published yet) — shipped insecure default configurations in both its Helm chart and Docker Compose deployments. Keycloak and its PostgreSQL backing database were exposed via Kubernetes NodePort service...
CVE-2026-86464
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Identity Manager IdM deployment included insecure default configurations and credentials for security-sensitive services. The Helm chart exposed the Keycloak service and its PostgreSQL...
CVE-2024-43917
CVE-2024-43917 This script demonstrates an SQL injection vulnerability found in the TI WooCommerce Wishlist plugin for WordPress, versions up to 2.8.2 CVE-2024-43917. The vulnerability allows unauthenticated users to execute arbitrary SQL commands on the website’s database, potentially exposing...
CVE-2026-32662
CVE-2026-32662: Active Debug Code in Production Advisory Field| Value ---|--- CVE| CVE-2026-32662 ICSA| ICSA-26-055-03 Update A CVSS 3.1| 5.3 Medium Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE| CWE-489 Active Debug Code Researcher| Michael Groberman — Gr0m Published| 2026-04-02 Updat...
EUVD-2026-73934
Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network...
CVE-2026-81387
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...
CVE-2026-81381
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network...
CVE-2026-73008
Exposure of private personal information to an unauthorized actor in Windows Biometric Service allows an authorized attacker to disclose information locally...
CVE-2026-71330
Exposure of sensitive system information to an unauthorized control sphere in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to disclose information over a network...
CVE-2026-69806
Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally...
CVE-2026-69723
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information over a network...
CVE-2026-67383
Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network...
GHSA-6X6C-W9W9-HV4H Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Impact Sensitive information exposure in the Infracost Terraform Cloud/Enterprise integration. Several code paths attached a configured secret token to a request whose host was taken straight from the scanned Terraform, with no check that the host was the trusted endpoint. The condition that...
CVE-2026-28671
CVE-2026-28671 is a race condition in the updateInternal method of MediaProvider.java within Android's Media Provider Project Mainline component. The flaw allows local information disclosure of file contents without requiring additional privileges or user interaction. It affects Android 14, 15, a...
CVE-2026-28671
In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2024-37051
CVE-2024-37051 Analysis Overview CVE-2024-37051 is a vulnerability found in JetBrains' IntelliJ-based IDEs, affecting the GitHub plugin. It allows unauthorized exposure of GitHub access tokens when a malicious pull request PR is loaded. Technical Details The vulnerability occurs during the...