CVE-2026-78555

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-78555

RansomLook embedded complete API keys in hidden HTML form fields on the authenticated /admin/apikeys administration page, while the UI displayed only a shortened representation. The full tokens were included in forms for enable/disable, private-access, and delete actions, making them recoverable ...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

CVE-2026-71511 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in its Members REST API . Authenticated users with member-read privileges can query individual member or member list endpoints and retrieve bcrypt password verifiers that are not filtered by the base API serializer or the Mem...

EUVD-2026-65084

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-71511 Dolibarr < 24.0.0 Members REST API Sensitive Data Exposure via Member Endpoints

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt password verifiers by querying member endpoints. Attackers can call the individual member or member list endpoints to obta...

CVE-2026-78372

creationtimestamp| type| source ---|---|--- 2026-08-24 16:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mttoe7lkrt25 2026-08-24 16:08:24+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mttot3qvst2u...

Improper Validation of Syntactic Correctness of Input

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input through the normalizeIPv6 and parseWithStatus host-processing paths in lib/utils.js and index.js. An attacker can route an...

Malicious code in tkyoussef-hb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf8b5edde28ed5fd92096c6a23ffb5ff8ec8272b6b52ec52c49d9cacab79ee69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-76054

Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's build to obtain the Black Duck API token via the ambient process environment, which is inherited by subprocesses launched...

Security Bulletin: Langflow is affected by weaknesses in secret handling and sensitive configuration access

Summary Langflow includes features for secret protection, environment access, and runtime configuration of workflow components. Weaknesses in cryptographic key handling, exposure of process environment values, and insufficient restriction of sensitive runtime configuration fields could allow...

Security Bulletin: Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

Summary Langflow OSS supports custom Python components and validation of component code for component development workflows. Weaknesses in custom component execution paths, validation endpoints, and trusted template enforcement could allow authenticated users to execute arbitrary Python code or...

CVE-2026-76847

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

EUVD-2026-64890

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...