CVE-2026-53525

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...

CVE-2026-53525 WeeChat has Non-Constant-Time Password Hash Comparison in Relay Authentication

WeeChat Wee Enhanced Environment for Chat is a free chat client. In versions 0.3.1 through 4.9.0, the WeeChat relay authentication uses non-constant-time string comparison functions weechatstrcasecmp and strcmp to verify password hashes and plaintext passwords. An attacker can exploit timing...

CVE-2026-53525

WeeChat (a free chat client) versions 0.3.1 through 4.9.0 are affected by a timing side-channel in relay authentication. The relay uses non-constant-time string comparison functions (weechat_strcasecmp and strcmp ) to verify password hashes and plaintext passwords. An attacker can exploit timing ...

PT-2026-79060

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web auth middleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when password hash is None. A fresh deployment reaches that state when DBX PASSWORD is unset and no stored password...

CVE-2026-62673

Grav (file-based web platform) prior to 2.0.4 contains a case-sensitivity flaw in its default .htaccess and webserver-configs/htaccess.txt. Three Apache RewriteRule directives that block access to sensitive file types (.yaml, .php, .json, etc.) under user/ and system/vendor/ omit the [NC] flag, m...

EUVD-2026-62543

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache NC flag and therefore compare sensitive directory and file-extension patterns case-sensitively. On a case-insensitive filesystem, an unauthenticated requester ca...

PT-2026-78514

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4 Description Security rules in .htaccess and webserver-configs/htaccess.txt omit the Apache NC No Case flag, causing sensitive directory and file-extension patterns to be compared case-sensitively. On case-insensiti...

CVE-2026-62988

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and...

GHSA-7788-GHFQ-C6MH Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

Summary Several Froxlor API command classes return sensitive authentication material in JSON API responses. The affected endpoints retrieve full database rows using SELECT , SELECT alias., or equivalent full-row queries, then return the results directly through $this-response... without removing...

GHSA-M5PQ-69XG-VCQ3 devpi-server may leak database contents

Impact If the replication protocol is enabled by using the primary or deprecated master role for a server instance, then the +changelog URL route can be used to read the complete database content including password hashes, and the ids and salts of tokens from devpi-tokens by using a trivially...

EUVD-2026-61218

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...

EUVD-2026-61216

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and...

CVE-2026-62988 Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and...

CVE-2026-62988 Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and...

CVE-2026-62988

Froxlor versions 2.3.7 through 2.3.8 expose password hashes and Base32-encoded TOTP seeds via API endpoints (Customers, Admins, Ftps commands). An authenticated caller can crack hashes offline and generate valid 2FA codes, enabling full account takeover. Upgrade to 2.3.8 and reset 2FA secrets for...

CVE-2026-62684

File Browser prior to 2.63.17 exposes the bcrypt password_hash and the bypass token of password-protected shares in API responses. The root cause is that the Link storage struct is serialized directly via unfiltered json.Marshal in sharePostHandler, shareListHandler, and shareGetsHandler, so both...

CVE-2026-62684 File Browser: Share API exposes the password hash and bypass token

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST...

CVE-2026-62684

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST...

EUVD-2026-60961

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST...

CVE-2026-62684 File Browser: Share API exposes the password hash and bypass token

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struct is serialized directly by sharePostHandler, shareListHandler, and shareGetsHandler through renderJSON, causing POST...