CVE-2026-77438 Trilium unauthenticated share-search discloses password-protected and hidden shared notes

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and conten...

KMS master key exposure via unredacted credential serialization in driver settings string

A weakness in the client-side encryption configuration surface of the MongoDB C Driver causes sensitive key-management credential material supplied by the application to be reproduced verbatim in the driver's human-readable diagnostic representation of its client settings, instead of being masked...

CVE-2026-75960

Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions...

CVE-2026-3035

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

EUVD-2026-66431

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

CVE-2026-3035 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

CVE-2026-3035

GitLab EE is affected by an improper authorization check that allows an authenticated user with project Maintainer permissions to access the terminal of a protected environment they are not authorized to use, under certain conditions. The vulnerability affects versions from 11.3 before 19.1.7, 19...

CVE-2026-3035 Authentication Bypass Using an Alternate Path or Channel in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

CVE-2026-75960 Insufficiently Protected Credentials in Rently Smart Home

Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions...

CVE-2026-75960 Insufficiently Protected Credentials in Rently Smart Home

Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions...

CVE-2026-75960

Rently Smart Home versions 20.1.0 and prior are affected by an Insufficiently Protected Credentials vulnerability that allows an attacker to retrieve PINs, including the Master Pin , thereby overriding standard user permissions. CISA rates this HIGH severity (CVSS 3.1: 8.1, CVSS 4.0: 8.7) with a ...

PT-2026-82102

Name of the Vulnerable Software and Affected Versions Rently Smart Home versions 20.1.0 and earlier Description Insufficiently protected credentials in the API allow an attacker to retrieve pins, including the Master Pin. This issue enables the override of standard user permissions, potentially...

CVE-2026-75960: Insufficiently Protected Credentials

Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions...

GitLab 11.3 < 19.1.7 / 19.2 < 19.2.5 / 19.3 < 19.3.1 (CVE-2026-3035)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with projec...

CAPTCHA Protected Page - Moderately critical - Cookie Forgery - SA-CONTRIB-2026-105

This module enables site administrators to require CAPTCHA confirmation on specific pages. The module does not sufficiently validate its CAPTCHA verification cookies. Under certain circumstances, an unauthenticated user or automated bot can forge the cookie and bypass CAPTCHA verification entirel...

CVE-2026-3035: Authentication Bypass Using an Alternate Path or Channel

GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were no...

PT-2026-82099

Name of the Vulnerable Software and Affected Versions GitLab EE versions 11.3 through 19.1.6 GitLab EE versions 19.2 through 19.2.4 GitLab EE versions 19.3 Description An improper authorization check allows an authenticated user with project Maintainer permissions to access the terminal of a...

CVE-2026-65087

NVIDIA NemoClaw contains a vulnerability due to insufficiently protected credentials . A successful exploit could lead to information disclosure and data tampering . The CVSS 3.1 base score is 5.6 (Medium) , with a local attack vector , low attack complexity, low privileges required, and user int...

WordPress FiboSearch plugin < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure vulnerability

Unauthenticated Password-Protected Product Information Disclosure vulnerability discovered by Duy Tran in WordPress Plugin FiboSearch versions 1.34.1...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' in the initializecopywithargs function. An attacker can cause a process crash by passing a non-Node argument, such as ...