PT-2026-66575

Name of the Vulnerable Software and Affected Versions Spikster versions prior to commit e1cdf8c Description A missing authentication flaw allows unauthenticated remote attackers to access all API routes. This occurs because the CipiAuth middleware is registered but not applied to any route within...

Linux Distros Unpatched Vulnerability : CVE-2026-17840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect security UI in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. Chromiu...

PT-2026-66144

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 151.0.7922.72 Description Insufficient policy enforcement in the Passwords component allows a remote attacker to bypass discretionary access control, which is a security mechanism that restricts acces...

PT-2026-66288

Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Low...

CSL 1010 M2M 3G WiFi Module 2.2.1.4 (Router.cfg) Weak XOR Encryption

Summary The CSL 1010 M2M 3G WiFi Module is a portable 3G/LTE router that stores its configuration in a backup file Router.cfg. Description The device protects its configuration file Router.cfg with a weak/insecure obfuscation single-byte XOR cipher using a static key 0xEC instead of real...

CVE-2026-67595

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

CVE-2025-67405

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in updatepassword.php via the parameter newpassword...

CVE-2026-67595 VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

CVE-2026-67595 VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

CVE-2026-67595 VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload embedded in the Blade template responsible for rendering security OTP emails, allowing remote attackers to execute unauthorized code in any browser that renders the affected email template with JavaScript...

CVE-2026-8497

Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate...

CVE-2026-8497

CVE-2026-8497 describes an issue in Devolutions Password Manager (versions up to 2026.2.1.0) where Devolutions Server connection handling performs improper certificate validation on Android, iOS, and macOS. This allows an adjacent-network attacker to intercept and modify sensitive information thr...

CVE-2026-8497

Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate...

EUVD-2026-50422

Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate...

GHSA-RWQX-FVQH-6WM4 OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords

OpenTelemetry Java Instrumentation JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends...

EUVD-2026-41151

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords...

CVE-2026-65887

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins...

CVE-2026-65887 Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins...

CVE-2026-65887

CVE-2026-65887 affects the Joomla Extension Gridbox by balbooa.com (versions earlier than 2.20.2). The vulnerability arises from an insecure resetPassword function that allows unauthenticated actors to reset any user password (excluding super admins), enabling login as those users and performing ...

CVE-2026-65887 Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins...