EUVD-2026-84893

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information...

CVE-2026-18176

The IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability that could allow a remote attacker to obtain sensitive information . This occurs because sensitive information is transmitted in cleartext . No specific component details, exploit information, or remed...

CVE-2026-18169

The IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability that allows a remote authenticated attacker to obtain sensitive information . The root cause is the improper validation of symbolic links . The vulnerability is assigned a CRITICAL base severity score ...

CVE-2026-17643

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by multiple vulnerabilities. A local attacker could obtain sensitive information and perform unauthorized actions because of insufficiently protected credentials . Exploitation details and specific remediation steps are not ...

CVE-2026-76717

A vulnerability exists in the HPE Networking Analytics and Location Engine (ALE) API , allowing an unauthenticated remote attacker to disclose sensitive information. By providing specially crafted input to a specific API endpoint, an attacker can obtain sensitive user data, including password has...

CVE-2026-76717 Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the Analytics and Location Engine ALE API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result...

CVE-2026-76710

A vulnerability in the HPE Networking Analytics and Location Engine (ALE) management interface allows an unauthenticated remote attacker to disclose sensitive information. By sending specially crafted requests to specific internal endpoints, an attacker can gain access to site hierarchy , infrast...

CVE-2026-76805

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...

CVE-2026-76805

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...

EUVD-2026-84557

Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal: true extractor...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

rConfig <3.9.4 - Sensitive Information Disclosure

rConfig prior to version 3.9.4 is susceptible to sensitive information disclosure. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application does not exit after a redirect is applied, the rest of the page still executes,...

WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure

WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. id: CVE-2021-24146 info: name: WordPress Modern Events Calendar Lite 5.16.5 - Sensitive Information Disclosure...

Akkadian Provisioning Manager 4.50.02 - Sensitive Information Disclosure

Akkadian Provisioning Manager 4.50.02 could allow viewing of sensitive information within the /pme subdirectories. id: CVE-2020-27361 info: name: Akkadian Provisioning Manager 4.50.02 - Sensitive Information Disclosure author: gy741 severity: high description: Akkadian Provisioning Manager 4.50.0...

Cuppa CMS v1.0 - Local File Inclusion

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php. id: CVE-2022-25486 info: name: Cuppa CMS v1.0 - Local File Inclusion author: theamanrawat severity: high description: | CuppaCMS v1.0 was discovered to contain a local file...

Adobe Experience Manager - Expression Language Injection

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 has an expression language injection vulnerability. id: CVE-2019-16469 info: name: Adobe Experience Manager - Expression Language Injection author: DomenicoVeneziano severity: high description: | Adobe Experience Manager versions...

CVE-2021-43798-grafana_fileread

CVE-2021-43798-grafanafileread Если объект обработан через обратный прокси, можно заменить payload на этот root@kitploit: url1 = url +"/public/plugins/"+str.rstripplugins+"//../..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd" Grafana — это кроссплатформенная веб-платформа с открытым исходным...

CVE-2026-93982: Insertion of Sensitive Information into Log File

OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests...

CVE-2026-92708: Exposure of Sensitive Information to an Unauthorized Actor

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure vulnerability

Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure vulnerability discovered by Sorra in WordPress Plugin LatePoint versions = 5.6.9...