Hackers steal and publish data on 41,000 Homeland Security workers

.kadence-column482644f2c16d-bc .kt-inside-inner-colpadding-top:20px;padding-right:20px;padding-bottom:10px;padding-left:20px;.kadence-column482644f2c16d-bc .kt-inside-inner-colcolumn-gap:var--global-kb-gap-sm, 1rem;.kadence-column482644f2c16d-bc...

CVE-2026-66091

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details username, first name, last name and email address withi...

CVE-2026-66091

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details username, first name, last name and email address withi...

CVE-2026-66091

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details username, first name, last name and email address withi...

EUVD-2026-112567

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details username, first name, last name and email address withi...

CVE-2026-66091: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or…

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details username, first name, last name and email address withi...

openEQUELLA authorization issue vulnerability

OpenEQUELLA versions from 2019.2 up to but including 2026.1 contain an authorization vulnerability. This vulnerability arises because the GET /api/userquery/userinfobackup endpoint lacks authentication or authorization checks. Unauthenticated attackers can retrieve personal details such as...

PT-2026-130613

In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details username, first name, last name and email address withi...

EUVD-2026-111697

The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details...

CVE-2026-103372 Payconiq for WooCommerce <= 1.0.4 - Unauthenticated Order Key Disclosure

The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details...

CVE-2026-103372

The Payconiq WordPress plugin (version 1.0.4 and earlier) contains a vulnerability where it fails to verify if a visitor is authorized to view an order before providing a confirmation link. This flaw allows unauthenticated users to obtain keys for any paid order. Additionally, for recent guest or...

CVE-2026-103372: Unknown Payconiq: The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning…

The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details...

EUVD-2022-33944

Malicious code in bioql PyPI...

EUVD-2024-46507

Malicious code in bioql PyPI...

Renault UK Customer Records Stolen in Third-Party Breach

Renault UK warns customers of a third-party data breach exposing personal details, stressing vigilance against fraud and confirming no bank data lost...

Fake Bureau of Motor Vehicles texts are after your personal and banking details

Scammers are sending out texts that claim to be from the Bureau of Motor Vehicles BMV, saying that you have outstanding traffic tickets. Here's an example, which was sent to one of our employees. “Ohio BMV Final Notice: Enforcement Begins September 10nd. Our records indicate that as of today, you...

Everest Ransomware Leaks Coca-Cola Employee Data Online

Everest ransomware leaks Coca-Cola employee data: 1,104 files exposed, including HR, admin roles, IDs, personal details, and internal records...

CVE-2024-5270

Mattermost versions 9.5.x = 9.5.3, 9.7.x = 9.7.1, 9.6.x = 9.6.1 and 8.1.x = 8.1.12 fail to check if the email signup configuration option is enabled when a user requests to switch from SAML to Email. This allows the user to switch their authentication mail from SAML to email and possibly edit...

CVE-2022-29613

Due to insufficient input validation, SAP Employee Self Service allows an authenticated attacker with user privileges to alter employee number. On successful exploitation, the attacker can view personal details of other users causing a limited impact on confidentiality of the application...

CVE-2022-30359

OvalEdge 5.2.8.0 and earlier is affected by a Sensitive Data Exposure vulnerability via a GET request to /user/getUserList. Authentication is required. The information disclosed is associated with the all registered users, including user ID, status, email address, roles, user type, license type,...