PropertyGuru AgentNet Singapore App security vulnerability

The PropertyGuru AgentNet Singapore App is a mobile application used by PropertyGuru in Singapore as an real estate agency. The PropertyGuru AgentNet Singapore App versions prior to 23.7.10 contained a security vulnerability, which was caused by the use of hardcoded encryption keys for parameters...

Dialogue App security vulnerabilities

Dialogue App is an artificial intelligence dialogue application developed by Dialogue Company. Versions of Dialogue App 4.3.2 and earlier contained security vulnerabilities, which were caused by the use of a hardcoded encryption key for the parameter SEGMENTWRITEKEY...

Noelse Individuals & Pro App security vulnerabilities

Noelse Individuals & Pro App is a financial services app developed by the French company Noelse, designed for individual and professional users to manage online accounts, handle payments, and access financial tools. The Noelse Individuals & Pro App versions 2.1.7 and earlier contain security...

PT-2026-30224

Name of the Vulnerable Software and Affected Versions Storage credentials in mobile app and device firmware affected versions not specified Description The mobile app and device firmware contain hardcoded storage credentials that do not adequately limit end user permissions and do not expire with...

PT-2026-30258

Name of the Vulnerable Software and Affected Versions GarrettCom Magnum 6K affected versions not specified GarrettCom Magnum 10K affected versions not specified Description An authentication bypass exists in the authentication mechanism due to a hardcoded string. This allows unauthenticated...

Belden GarrettCom Magnum 6K and Belden GarrettCom Magnum 10K have vulnerabilities related to trust management.

Both the Belden GarrettCom Magnum 6K and the Belden GarrettCom Magnum 10K are modular industrial Ethernet switches produced by the American company Belden. Both devices have vulnerabilities related to trust management. These vulnerabilities stem from hardcoded strings within the authentication...

Investory Toy Planet Trouble App security vulnerability

Investory Toy Planet Trouble App is an educational adventure game app developed by Investory. Versions of Investory Toy Planet Trouble App prior to 1.5.5 contained a security vulnerability, which was caused by the use of a hardcoded encryption key for the parameter currentkey...

Align My Invisalign App security vulnerability

Align My Invisalign App is an application developed by Align Company, designed to support orthodontic treatment. Version 3.12.4 of Align My Invisalign App contains a security vulnerability, which stems from the use of hardcoded encryption keys for the parameter CDAACCESSTOKEN...

Gardyn Home Kit Cloud API and Gardyn Mobile Application have vulnerabilities related to trust management.

Gardyn Home Kit Cloud API and Gardyn Mobile Application are products of the American company Gardyn. Gardyn Home Kit Cloud API is an indoor hydroponic cultivation system. Gardyn Mobile Application is a mobile control application. There are security vulnerabilities in Gardyn Home Kit Cloud API and...

Credential Leakage in LLM Agent Skills: A Large-Scale Empirical Study

Third-party skills extend LLM agents with powerful capabilities but often handle sensitive credentials in privileged environments, making leakage risks poorly understood. We present the first large-scale empirical study of this problem, analyzing 17,022 skills sampled from 170,226 on SkillsMP usi...

Wahoo Fitness SYSTM App security vulnerabilities

The Wahoo Fitness SYSTM App is a comprehensive structured training app developed by Wahoo Fitness in the United States. The Wahoo Fitness SYSTM App versions 7.2.1 and earlier contained security vulnerabilities, which stemmed from the use of hardcoded encryption keys for the SEGMENTWRITEKEY...

MAL-2026-2431 Malicious code in nwin32tls (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a47778618cad57dbc584afdff7ed138032b69c423a9812e1bc8f86c13129f01d Importing the module starts a loop that listens to key strokes and on every capslock press exfiltrates screenshot to a hardcoded location. --- Category:...

CVE-2026-25601

A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryptographic key within the Mx.Web.ComponentModel.dll component. When the option to store domain passwords was enabled, this key was used to encrypt user...

Shinrays Games Goods Triple App security vulnerability

Shinrays Games Goods Triple App is an application for trading virtual game goods by Shinrays Games. Versions of Shinrays Games Goods Triple App 1.200 and earlier contained a security vulnerability. This vulnerability stemmed from incorrect handling of parameters AESIV/AESPASSWORD in the jRwTX.jav...

GHSA-HQXF-MHFW-RC44 AVideo: CSRF on Plugin Enable/Disable Endpoint Allows Disabling Security Plugins

Summary The AVideo endpoint objects/pluginSwitch.json.php allows administrators to enable or disable any installed plugin. The endpoint checks for an active admin session but does not validate a CSRF token. Additionally, the plugins database table is explicitly listed in ignoreTableSecurityCheck,...

CVE-2026-34237

MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1...

EUVD-2026-17869

A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryptographic key within the Mx.Web.ComponentModel.dll component. When the option to store domain passwords was enabled, this key was used to encrypt user...

CVE-2026-25601

A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryptographic key within the Mx.Web.ComponentModel.dll component. When the option to store domain passwords was enabled, this key was used to encrypt user...

CVE-2026-25601 Credential Exposure vulnerability in MEPIS RM

A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryptographic key within the Mx.Web.ComponentModel.dll component. When the option to store domain passwords was enabled, this key was used to encrypt user...

CVE-2026-25601 Credential Exposure vulnerability in MEPIS RM

A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contained a hardcoded cryptographic key within the Mx.Web.ComponentModel.dll component. When the option to store domain passwords was enabled, this key was used to encrypt user...