CVE-2023-54402

The software iDocView is vulnerable to a Server-Side Request Forgery (SSRF) flaw in its /doc/upload endpoint. Remote unauthenticated attackers can bypass authentication by using a hardcoded default token value (testtoken ) to fetch arbitrary URLs. Due to unrestricted URL scheme handling, includin...

GO-2026-6529 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets in github.com/anycable/anycable-go

AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets in github.com/anycable/anycable-go. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...

GHSA-W72W-9QMJ-C9QM AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

Summary The telemetry subsystem embeds a hardcoded auth token "secret" in the public source and transmits raw CLI arguments—including --secret, --jwtsecret, and --httprpcsecret values—to a third-party telemetry endpoint. Details In telemetry/config.go line 12, var authToken = "secret" is committe...

AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

Summary The telemetry subsystem embeds a hardcoded auth token "secret" in the public source and transmits raw CLI arguments—including --secret, --jwtsecret, and --httprpcsecret values—to a third-party telemetry endpoint. Details In telemetry/config.go line 12, var authToken = "secret" is committe...

CVE-2026-63406

AnyCable versions prior to 1.6.15 contain a confidentiality issue in its telemetry subsystem. The file telemetry/config.go embeds a hardcoded public authToken ("secret") used to authenticate to telemetry.anycable.io, while clusterFingerprint() in telemetry/telemetry.go incorporates raw CLI argume...

CVE-2026-63406 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and...

CVE-2026-63406 AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with a hardcoded public authToken, while clusterFingerprint in telemetry/telemetry.go reads the full configuration file and...

Malicious code in discord-players (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eadb25768efba4ff9dc9170a838f90f6572993195d37e526543fa956e65faa2 index.js is the package main and unconditionally starts a backup loop at module top level. On require, BackupManager zips process.cwd excluding...

CVE-2026-71801

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...

CVE-2026-76009

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

CVE-2026-76009

The Next-Cart Store to WooCommerce Migration WordPress plugin (versions ≤ 3.9.8) is vulnerable to unauthenticated authentication bypass via the NCWM_Kitconnect::run() function. The REST route /wp-json/next_cart/v1/migration is registered with permission_callback set to __return_true and relies on...

CVE-2026-76009 Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

EUVD-2026-74689

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

CVE-2026-76009 Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWMKitconnect::run function. This is due to the plugin registering the /wp-json/nextcart/v1/migration REST route with permissioncallback se...

CVE-2026-71801

The s-pms SPMS-Server (through v1.0) is vulnerable to an authentication bypass due to a hardcoded default access token secret within its core configuration file. Because this secret is not removed or overridden in production profiles, a remote, unauthenticated attacker can forge valid administrat...

PT-2026-88850

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the NCWM Kitconnect::run function. This is due to the plugin registering the /wp-json/next cart/v1/migration REST route with permission callback...

CVE-2026-71801

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in the production environment profile. A remote, unauthenticated attacker can locally forge valid...

CVE-2026-16259

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing...

CVE-2026-16259 Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing...

CVE-2026-16259

The Uix UserCenter WordPress plugin (versions through 1.0.3 ) contains an unauthenticated privilege escalation vulnerability. The flaw exists because the plugin fails to verify account ownership during unauthenticated profile-update actions and utilizes a hardcoded signing key that is identical a...