Behat Configuration File Detected

Behat is a Behavior Driven Development BDD framework for PHP. It allows the execution of feature documentation written in business-facing text. Behat uses a configuration file named behat.yml to set up various options and parameters for running tests. The presence of the behat.yml configuration...

PT-2026-1267

Name of the Vulnerable Software and Affected Versions WP Swings Wallet System for WooCommerce versions through 2.7.2 Description A flaw exists in WP Swings Wallet System for WooCommerce that allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent...

JFrog Artifactory Artifacts Repository Detected

JFrog Artifactory is a popular repository management tool used to store and manage software artifacts. If the Artifacts repository is detected and accessible, it may expose sensitive information or allow unauthorized access to stored artifacts. No source data...

PT-2026-1268

Name of the Vulnerable Software and Affected Versions Brecht Custom Related Posts versions through 1.8.0 Description A flaw exists in Brecht Custom Related Posts that allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations Upda...

CVE-2025-34171

CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image endpoint can be abused with a user-controlled path parameter to access files under...

LFI-DVWA-Lab-

LFI Exploitation – DVWA Lab 📌 Overview This project demons...

CVE-2025-9110

An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the followin...

CVE-2025-67160

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal...

CVE-2025-67158

An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitive information and escalate privileges via a crafted HTTP request...

CVE-2026-21447

Bagisto is an open source laravel eCommerce platform. Prior to version 2.3.10, an Insecure Direct Object Reference vulnerability in the customer order reorder function allows any authenticated customer to add items from another customer's order to their own shopping cart by manipulating the order...

CVE-2026-21445 Langflow Missing Authentication on Critical API Endpoints

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories...

CVE-2026-21445 Langflow Missing Authentication on Critical API Endpoints

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories...

CVE-2025-67160

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal...

CVE-2025-67158

An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitive information and escalate privileges via a crafted HTTP request...

CVE-2025-67160

An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal...

CVE-2025-34171

CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug information. The /v1/users/image endpoint can be abused with a user-controlled path parameter to access files under...

CVE-2025-9110

An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the followin...

CVE-2025-9110

An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the followin...

CVE-2025-62840

A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local network access, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following...

CVE-2025-62840

CVE-2025-62840 affects HBS 3 Hybrid Backup Sync. The issue is a flaw where generating an error message can disclose sensitive information, enabling a local attacker on the same network to read application data. Affected component is the HBS 3 Hybrid Backup Sync error-message handling; root cause ...