CVE-2026-15341

The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The synchronizesession function, hooked on init and therefore executed on every request, performs no nonce, capability, or shared-secr...

MINI-RG49-H5RP-JFGR

Bulletin has no description...

CVE-2026-73650 vulnerabilities

Vulnerabilities for packages: arangodb...

CVE-2026-64887 Airwall - Hardcoded Secrets

Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack. This issue affects Airwall: before 4.1...

GO-2026-4543 vulnerabilities

Vulnerabilities for packages: gatus...

GO-2026-5887 vulnerabilities

Vulnerabilities for packages: gatus...

CVE-2026-17468

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key...

CVE-2026-17468 IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key...

CVE-2026-17468

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key...

CVE-2026-17468 IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key...

EUVD-2026-58454

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to forge valid session tokens due to the use of a hardcoded cryptographic key...

CVE-2026-17468

CVE-2026-17468 affects IBM Documentation Offline (versions 1.0.0–1.4.1). The embedded server uses a hardcoded session secret, enabling a remote attacker to forge valid session tokens and manipulate client-side state (session forgery). This is part of multiple vulnerabilities in the IBM Documentat...

CVE-2026-18164

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

CVE-2026-13460

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

CVE-2026-13460

CVE-2026-13460 affects IBM Storage Scale GUI, with versions 5.2.3.0–5.2.3.8 and 6.0.0.0–6.0.1.0 containing a hardcoded token in the GUI source used for inter-node cluster communication and REST API authentication. The security bulletin indicates fixes in 5.2.3.9 or later and 6.0.1.1 or later. Rem...

EUVD-2026-58361

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

CVE-2026-13460 The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

CVE-2026-13460

IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI...

EUVD-2026-58274

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...

CVE-2026-67614

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed...