32704 matches found
PT-2026-70592
Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Description Improper removal of sensitive information before storage or transfer allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, there is no informatio...
Devolutions Server <= 2026.1.22 / 2026.2.0 <= 2026.2.11 Multiple Vulnerabilities (DEVO-2026-0024)
The version of Devolutions Server installed on the remote host is prior or equal to 2026.1.22 or 2026.2.0 prior or equal to 2026.2.11. It is, therefore, affected by multiple vulnerabilities, including: - Improper authorization in the access request status endpoint allows an authenticated...
PT-2026-70389
Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally...
PT-2026-70409
Name of the Vulnerable Software and Affected Versions AMD Zen affected versions not specified Description An issue in AMD Zen allows an authorized attacker to locally disclose sensitive information, which can affect the system. Recommendations At the moment, there is no information about a newer...
CVE-2026-62900
Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...
PT-2026-70937
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...
PT-2026-70765
Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description An out-of-bounds read allows an unauthorized attacker to disclose sensitive information over a network. Recommendations At the moment, there is no information about a newer...
PT-2026-70621
Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description An out-of-bounds read exists in Microsoft Office Word, which allows an unauthorized attacker to disclose sensitive information locally and affect the system. An out-of-bounds re...
PT-2026-70904
『We recently revisited those patches and found that none of the underlying root causes were fixed - every original CVE remained exploitable,』😩 SonicWall GMS - Unauthenticated RCE and Encrypted Password Hash Extraction CVE-2026-66145 https://t.co/hp0HOWboM9...
CVE-2025-30239 Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices
In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted...
CVE-2025-30239
CVE-2025-30239 affects TP-Link Aginet devices where hardcoded cryptographic keys in firmware can be recovered from device storage, enabling decryption of stored data and access to sensitive configuration information (including credentials). Exploitation details and fixes are not provided in the a...
CVE-2025-30239 Sensitive Data Exposure due to Hardcoded Cryptographic Keys in Multiple TP-Link Aginet Devices
In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted...
CVE-2026-72908 ERPNext: Possibility of SQL injection due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the gettaxtemplate function in erpnext/accounts/doctype/taxrule/taxrule.py constructs an SQL WHERE clause from request-influenced postingdate and args values, allowing an authenticated low-privileg...
CVE-2026-72908
ERPNext contains an SQL injection in get_tax_template (erpnext/accounts/doctype/tax_rule/tax_rule.py) exploitable by an authenticated low-privilege user through request-influenced posting_date and args values. The issue affects pre-15.109.0 and pre-16.20.0 releases and can lead to extraction of s...
EUVD-2026-55737
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...
CVE-2026-72759 cti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion
In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns None. The previous logic only denied access when the conversion object...
CVE-2026-6373
Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026...
CVE-2026-12984
Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026...
CVE-2026-12984
CVE-2026-12984 concerns Zyxel Networks WAH7601 (affected through 20072026). The vulnerability is described as Insufficiently Protected Credentials that allows retrieval of embedded sensitive data. Connected documents confirm the affected product and the core impact, but do not provide detailed ro...
CVE-2026-12984 Exposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601
Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026...