CVE-2026-81320 Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

EUVD-2026-78276

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CVE-2026-81320

hawtio-operator (used in the OpenShift ecosystem) leaks the TLS private key in PEM format when a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher . The entire Route object is serialized to JSON and written to the operator's standard output, which is typic...

CVE-2026-81320

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

Exploit for CVE-2026-44351

CVE-2026-44351 — Falsificación de JWT por Secret Vacío en fas...

PT-2026-93181

Name of the Vulnerable Software and Affected Versions Wärtsilä FOS-Onboard affected versions not specified Description A hardcoded cryptographic server key exists within the deployer-ng Update Controller component. This issue involves the use of a fixed key for cryptographic operations, which can...

EUVD-2026-78815

Tenda Technology Co., Ltd NVR4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key...

CVE-2026-79551

Tenda Technology Co., Ltd NVR4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key...

CVE-2026-79551

The Tenda Technology Co., Ltd NVR_4H (hardware version CH3 v2.1 ) running firmware V27.5.58.6 contains a hardcoded ECDSA private key and certificate within the user-x.squashfs partition. Because these keys are embedded in the read-only filesystem and are identical across all devices running this ...

PT-2026-92032

Name of the Vulnerable Software and Affected Versions Tenda Technology Co., Ltd NVR 4H CH3 version V27.5.58.6 Description The software contains a hardcoded cryptographic key, which is a fixed secret key embedded directly into the code, potentially allowing unauthorized decryption or authenticatio...

PT-2026-93213

NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd config show cgi.c, ipsec show cgi.c, and mod vpn remote/plan.json read handlers. Attackers can query l2tpd config show.cgi to expose stored IPsec PSK and RSA key material...

CVE-2026-79551

Tenda Technology Co., Ltd NVR4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key...

PT-2026-91863

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

PT-2026-92132

Name of the Vulnerable Software and Affected Versions Issabel Framework versions prior to commit b97dbaf Description The Issabel Framework contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across all installations. This allows unauthenticated remote...

PT-2026-93221

Name of the Vulnerable Software and Affected Versions Secret Server affected versions not specified Description An unauthenticated user with access to Secret Server can utilize a padding oracle—a side-channel attack that reveals information about the padding of encrypted data—to decrypt or encryp...

PT-2026-92055

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata...

CVE-2026-89026: Use of Hard-coded Cryptographic Key

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

CVE-2026-81320: Insertion of Sensitive Information into Log File

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CVE-2026-57134: Improper Authentication

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy in src/praisonai-ts/src/mcp/security.ts invokes the configured credential validator only when AuthMethod is api-key or bearer. Basic and OAuth policies accept any non-empty Authorization header without...

CVE-2026-91935: Server-Side Request Forgery (SSRF)

Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata...