70032 matches found
CVE-2026-42162
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...
PT-2026-76865
Name of the Vulnerable Software and Affected Versions hermes-studio version 0.6.26 Description A directory traversal issue allows a remote attacker to obtain sensitive information. This occurs through the validatePath function within the 'api/hermes/download' endpoint. Directory traversal is a fl...
PT-2026-76606
Name of the Vulnerable Software and Affected Versions openssl encrypt pip versions prior to 1.4.8 Description An information exposure issue exists where the diagnostic commands 'hsm fido2-test' and 'hsm onlykey-test' unconditionally print the full derived hardware pepper as hex to stdout/stderr v...
PT-2026-73238
Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an isinstancestr guard — so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with...
PT-2026-76856
A logic issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to leak sensitive user information...
PT-2026-76879
Name of the Vulnerable Software and Affected Versions Mahara versions prior to 25.04.5 Mahara versions prior to 26.04.0 Description An issue exists where artefacts may become accessible to unauthorized users if the file path to an artefact within a page is manipulated. Recommendations Update to...
PT-2026-73268
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network...
CVE-2026-51346
SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...
PT-2026-76874
Name of the Vulnerable Software and Affected Versions Mattermost Desktop App versions prior to 6.2.2.0 Description The application fails to redact the pre-auth secret during the generation of a diagnostics report. A local attacker with access to the user's log files or diagnostics report can obta...
PT-2026-76734
SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...
PT-2026-76866
Name of the Vulnerable Software and Affected Versions Onyx versions prior to 3.1.10 Onyx versions prior to 3.2.14 Onyx versions prior to 4.0.0 Description An issue exists where the 'GET /api/mcp/servers' and 'GET /api/mcp/servers/persona/persona id' endpoints expose the OAuth Authorization header...
PT-2026-73266
Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...
PT-2026-76694
Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2025.3.156085 JetBrains YouTrack versions prior to 2026.1.13913 JetBrains YouTrack versions prior to 2026.2.18112 Description An unauthenticated attacker can download database backups by utilizing a shared...
PT-2026-73267
Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network...
PT-2026-73277
Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network...
PT-2026-76724
Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6 Description An issue exists in the as dict secure function within glances/config.py where the sanitization process only validates option names against a regex pattern and fails to inspect the actual values. This...
.NET: .NET Information Disclosure Vulnerability
Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...
FileRise <= 3.3.0 - Unauthenticated File Read
FileRise = 3.3.0 contains an unauthenticated file read vulnerability caused by a lack of access control on the /uploads directory, letting unauthenticated attackers access uploaded files directly, exploit requires knowledge or guessing of file paths. id: CVE-2026-25231 info: name: FileRise = 3.3....
LightRAG <= 1.5.4 - Missing Authentication
LightRAG through version 1.5.4 contains a broken access control vulnerability caused by the API server binding to all network interfaces with authentication disabled, letting unauthenticated network attackers fully control indexed documents and resources, exploit requires network access. id:...
