389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check

A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean...

MINI-FV7X-HWF3-W93G

Bulletin has no description...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

PT-2026-76865

Name of the Vulnerable Software and Affected Versions hermes-studio version 0.6.26 Description A directory traversal issue allows a remote attacker to obtain sensitive information. This occurs through the validatePath function within the 'api/hermes/download' endpoint. Directory traversal is a fl...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

EUVD-2026-60312

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

PT-2026-76615

openssl encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connectio...

CVE-2026-50776

Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - 04/2026 allows a remote attacker to obtain sensitive information and execute arbitrary code...

CVE-2026-71424: Exposure of Sensitive Information to an Unauthorized Actor

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...

CVE-2026-67918

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint...

CVE-2026-51346

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...

Duplicati 2.2.0.3 - JWT Signing Key Leak

Exploit Title: Duplicati 2.2.0.3 - JWT Signing Key Leak Bypass leading to Token Forgery Date: 2026-06-23 Exploit Author: Gabriel Rodrigues TEXUGO from HAKAI Vendor Homepage: https://www.duplicati.com Software Link: https://github.com/duplicati/duplicati Version: = 2.2.0.3 commit 6ad921166 and...

CVE-2026-50776

A Directory Traversal vulnerability exists in Pronis Loisirs Billetterie CSE -

CVE-2026-14564: Insufficiently Protected Credentials

Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114...

PT-2026-76637

Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114...

PT-2026-76748

Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - 04/2026 allows a remote attacker to obtain sensitive information and execute arbitrary code...

PT-2026-73276

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-75587: Exposure of Sensitive Information to an Unauthorized Actor

Mattermost Desktop App versions =6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the...

CVE-2026-42164: Exposure of Sensitive Information to an Unauthorized Actor

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section...