CVE-2026-61746 InvenTree: Plugin-settings GET endpoints are readable without authentication

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...

CVE-2026-61746

InvenTree , an open-source inventory management system, is vulnerable prior to 1.4.0 . The PluginSettingList , PluginAllSettingList , and PluginSettingDetail classes use GlobalSettingsPermissions without requiring IsAuthenticated, and since AuthRequiredMiddleware exempts /api/ paths, unauthentica...

CVE-2026-49810

Dell Command PowerShell Provider (DCPP) versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low-privileged attacker with local access can exploit this to achieve Information Disclosure . The Dell security advisory (DSA-2026-379) describes the issu...

CVE-2026-49810

Dell Command Powershell Provider DCPP, versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure...

CVE-2026-94494 jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user...

CVE-2026-94494

jshERP through 3.6 contains a tenant isolation bypass vulnerability in the GET /tenant/info endpoint (TenantController.java). Authenticated users can iterate the primary key to enumerate records of other tenants, exposing sensitive data such as login names, validity dates, user quotas, and enable...

CVE-2026-94494 jshERP through 3.6 Tenant Information Disclosure via GET /tenant/info

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user...

CVE-2026-94413 jshERP through 3.6 Password Hash Disclosure via /user/info

jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direc...

CVE-2026-94413

jshERP through 3.6 fails to redact password hashes in the /user/info endpoint. Authenticated users can retrieve unsalted MD5 password digests for any user by supplying arbitrary user IDs. The disclosed hashes are suitable for offline cracking or direct authentication bypass , enabling privilege e...

CVE-2026-94413 jshERP through 3.6 Password Hash Disclosure via /user/info

jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direc...

CVE-2026-61674

creationtimestamp| type| source ---|---|--- 2026-09-21 18:07:34+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mw2cjwmbns2t 2026-09-21 18:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mw2dacuhbl2t 2026-09-21 20:20:49+00:00| seen|...

CVE-2023-44150

creationtimestamp| type| source ---|---|--- 2026-09-21 18:07:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mw2cj7dn4y2y...

CVE-2026-94449

creationtimestamp| type| source ---|---|--- 2026-09-21 18:01:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mw2c7g7mwg2p...

CVE-2026-77561

creationtimestamp| type| source ---|---|--- 2026-09-21 17:44:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/fyq3mgwpbue2b 2026-09-22 22:35:27+00:00| published-proof-of-concept| https://github.com/tinyauthapp/tinyauth/security/advisories/GHSA-9xhm-w3wj-xhqh...

CVE-2026-0257

使用 TLS 的公钥伪造 GlobalProtect 身份验证覆盖 Cookie CVE-2026-0257 一个概念验证脚本，用于测试目标 PAN-OS GlobalProtect 门户或网关是否存在 CVE-2026-0257。该脚本会遍历 HTTPS 服务使用的证书链，并针对链中的每个公钥伪造一个有效的身份验证覆盖 Cookie，然后对 GlobalProtect 目标进行测试，验证其是否有效。 成功伪造的 Cookie 将登录 GlobalProtect 目标并检索 VPN 连接信息（使用 --verbose 参数查看详细信息）。 使用方法 root@kitploit: $...

CVE-2021-24545

CVE-2021-24545 現在はプラグインとしての配布が中止されているプラグインで発見されたXSS脆弱性です。 WordPress Plugin HTML Author Bio description XSS この脆弱性は、/wp-admin/profile.php の description パラメータに対する不適切な検証によって発生します。 リモートの攻撃者は、悪意を持って細工されたHTTPリクエストを送信することで攻撃することができます。 インストールおよび実行手順 1. WordPressのインストール インストールを進める際は、docker-compose.yml...

CVE-2026-53940

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...

USN-8796-1: OpenJDK 21 vulnerabilities

Kai Aizen discovered that the Networking component of OpenJDK 21 did not correctly handle user authentication. A remote attacker could possibly use this issue to leak sensitive information. CVE-2026-61308 It was discovered that the JSSE component of OpenJDK 21 did not correctly handle user...

USN-8795-1 openjdk-17 vulnerabilities

Kai Aizen discovered that the Networking component of OpenJDK 17 did not correctly handle user authentication. A remote attacker could possibly use this issue to leak sensitive information. CVE-2026-61308 It was discovered that the JSSE component of OpenJDK 17 did not correctly handle user...

CVE-2026-16651

creationtimestamp| type| source ---|---|--- 2026-09-21 16:01:32+00:00| seen| https://gist.github.com/ichintu/4a9aae7d3d8d22be0592bc020e91d67a 2026-09-22 11:40:51+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mw45fe6kuf2k...