EUVD-2026-92093

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...

CVE-2026-105147 SciPhi-AI R2R JWT Secret hard-coded credentials

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...

CVE-2026-105147

The SciPhi-AI R2R software (up to version 3.6.6 ) contains a vulnerability in the JWT Secret Handler component. The issue stems from the manipulation of the DEFAULT_BCRYPT_SECRET_KEY and DEFAULT_NACL_SECRET_KEY arguments, which leads to the use of hard-coded credentials . This vulnerability can b...

CVE-2026-105141

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105141 topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105141 topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105141 topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105141

The topoteretes cognee software (versions up to 1.5.4 ) contains a security flaw in the JWT Signing Key Handler component. Specifically, the get_user_id_by_email function within the file cognee/modules/users/authentication/get_api_auth_backend.py allows for the manipulation of the FASTAPI_USERS_J...

EUVD-2026-92086

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

cve-2024-6387_AImade

تقديم كود اختبار CVE-2024-6387 مقدمة يقدم هذا المستند نصاً برمجياً بلغة بايثون مصمماً لاختبار الثغرة CVE-2024-6387، التي تم تحديدها في OpenSSH. هذه الثغرة هي حالة سباق في معالج إشارة SIGALRM يمكن أن تسمح بتنفيذ تعليمات برمجية عن بُعد RCE على أنظمة لينكس القائمة على glibc. تم إنشاء النص البرمجي...

CVE-2026-33829-Writeup

تقرير CVE-2026-33829 دراسة حالة ثغرة: CVE-2026-33829 إجبار NTLM عبر أداة القص في ويندوز الملخص التنفيذي يشرح هذا التقرير إعادة الإنتاج التقني لثغرة CVE-2026-33829 ، وهي ثغرة كشف معلومات داخل إطار عمل تطبيق أداة القص الحديث في ويندوز. من خلال استغلال معامل إدخال غير مُتحقق منه داخل معالج بروتوكول...

PT-2026-104623

Name of the Vulnerable Software and Affected Versions SciPhi-AI R2R versions prior to 3.6.7 Description The JWT Secret Handler component contains hard-coded credentials. This issue occurs due to the manipulation of the DEFAULT BCRYPT SECRET KEY and DEFAULT NACL SECRET KEY arguments, which allows ...

PT-2026-104644

A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Handler. Executing a manipulation can lead to improper verification of cryptographic signature. The attack can be executed remotely. It is advisable to upgrade...

PT-2026-104617

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get user id by email of the file cognee/modules/users/authentication/get api auth backend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPI USERS JWT...

PT-2026-104658

A security flaw has been discovered in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This impacts an unknown function of the file delivery/delivery.php of the component Take Order Handler. The manipulation of the argument...

PT-2026-104651

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process single secret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument external id leads to incorrect permission assignment. The attack can be...

PT-2026-104626

A weakness has been identified in YzmCMS up to 7.6. Impacted is the function Password of the file /common/function/system.func.php of the component MD5 Handler. Executing a manipulation of the argument pass can lead to password hash with insufficient computational effort. The attack may be launch...

PT-2026-104660

A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected by this vulnerability is an unknown functionality of the file admin/admin.php of the component Role Attribute Handler...

CVE-2026-105165: Incorrect Permission Assignment for Critical Resource

A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function processsinglesecret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument externalid leads to incorrect permission assignment. The attack can be...

CVE-2026-105147: Use of Hard-coded Credentials

A vulnerability was determined in SciPhi-AI R2R up to 3.6.6. This affects an unknown part of the component JWT Secret Handler. This manipulation of the argument DEFAULTBCRYPTSECRETKEY/DEFAULTNACLSECRETKEY causes hard-coded credentials. The attack can be initiated remotely. The exploit has been...