66 matches found
CVE-2026-77938 Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance
Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTAPGURI, POSTGRESPASSWORD, a...
CVE-2026-102628 Cadmos LTI exposure of sensitive information via debug mode
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled APPDEBUG=true, APPENV=local in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment,...
CVE-2026-10128 Langflow is affected by weaknesses in secret handling and sensitive configuration access
IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment variables, exposing sensitive secrets despite security controls intended to disable custom components...
Test CGI Script - Detect
Test CGI script was detected. Response page returned by this CGI script exposes a list of server environment variables. !/usr/bin/env python3 -- coding: utf-8 -- """Test CGI script was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...
NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode SummaryWhen netlicensing-mcp is run in HTTP transport mode, the ApiKeyMiddleware fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler server.py:1427. The...
PT-2026-64100
Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode Summary When netlicensing-mcp is run in HTTP transport mode, the ApiKeyMiddleware fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler server.py:1427. The...
CVE-2026-56456
HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a...
CVE-2026-56456 HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability.
HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a...
CVE-2026-56456
HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a...
CVE-2026-56456
Technical details such as affected versions, components, root cause, and remediation are not provided in the supplied documents. Monitor for updates.
CVE-2026-49984
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can therefore smuggle a traversal sequence past...
SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access
Critical security vulnerabilities have been disclosed in SEPPMail Secure E-Mail Gateway, an enterprise-grade email security solution, that could be exploited to achieve remote code execution and enable an attacker to read arbitrary mails from the virtual appliance. "These vulnerabilities could ha...
SEPPmail Secure Email Gateway security vulnerability
SEPPmail Secure Email Gateway is an email security gateway developed by the German company SEPPmail. Versions of SEPPmail Secure Email Gateway prior to version 15.0.4 contained security vulnerabilities. These vulnerabilities stemmed from unvalidated endpoints in the new GINA UI, which exposed...
FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint
Summary An unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables including any database...
CVE-2025-62402
API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...
Apache Airflow security vulnerabilities
Apache Airflow is a set of open source platforms with the ability to create, manage and monitor workflows from the US Apache Apache Foundation. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow, which stems from the...
EUVD-2010-3966
Malware in sbrugna...
EUVD-2011-1723
Malware in sbrugna...