danmu_api - Unauthenticated Access to Admin API via Default Token

danmuapi before 1.21.7 contains an authentication bypass caused by default TOKEN usage and unset ADMINTOKEN, letting unauthenticated attackers modify server environment configuration via specific API endpoints, exploit requires default token configuration. id: CVE-2026-116485 info: name: danmuapi...

CVE-2026-116485

danmuapi before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMINTOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set...

EUVD-2026-109812

danmuapi before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMINTOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set...

CVE-2026-116485 danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints

danmuapi before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMINTOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set...

CVE-2026-77938 Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance

Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSandbox subprocesses inherit the full server environment. Attackers can run code via POST /v1/tools/run or custom tools to read LETTAPGURI, POSTGRESPASSWORD, a...

CVE-2026-102628 Cadmos LTI exposure of sensitive information via debug mode

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled APPDEBUG=true, APPENV=local in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment,...

CVE-2026-10128 Langflow is affected by weaknesses in secret handling and sensitive configuration access

IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment variables, exposing sensitive secrets despite security controls intended to disable custom components...

Test CGI Script - Detect

Test CGI script was detected. Response page returned by this CGI script exposes a list of server environment variables. !/usr/bin/env python3 -- coding: utf-8 -- """Test CGI script was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode

Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode SummaryWhen netlicensing-mcp is run in HTTP transport mode, the ApiKeyMiddleware fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler server.py:1427. The...

PT-2026-64100

Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode Summary When netlicensing-mcp is run in HTTP transport mode, the ApiKeyMiddleware fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler server.py:1427. The...

CVE-2026-56456

HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a...

CVE-2026-56456 HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability.

HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a...

CVE-2026-56456

Technical details such as affected versions, components, root cause, and remediation are not provided in the supplied documents. Monitor for updates.

CVE-2026-56456

HCL DFXAnalytics is affected by an Internal File Path Disclosure vulnerability. The application dashboard inadvertently leaks sensitive information regarding its internal file structure and directory paths through unhandled error messages, system logs, or debugging output, which could allow a...

CVE-2026-49984

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can therefore smuggle a traversal sequence past...

SEPPMail Secure E-Mail Gateway Vulnerabilities Enable RCE and Mail Traffic Access

Critical security vulnerabilities have been disclosed in SEPPMail Secure E-Mail Gateway, an enterprise-grade email security solution, that could be exploited to achieve remote code execution and enable an attacker to read arbitrary mails from the virtual appliance. "These vulnerabilities could ha...

SEPPmail Secure Email Gateway security vulnerability

SEPPmail Secure Email Gateway is an email security gateway developed by the German company SEPPmail. Versions of SEPPmail Secure Email Gateway prior to version 15.0.4 contained security vulnerabilities. These vulnerabilities stemmed from unvalidated endpoints in the new GINA UI, which exposed...

FacturaScripts Vulnerable to Unauthenticated phpinfo() Disclosure via Installer Endpoint

Summary An unauthenticated information disclosure vulnerability in the Installer controller allows any remote attacker to trigger phpinfo on a fresh FacturaScripts deployment by requesting /?phpinfo=TRUE, exposing full PHP configuration, server environment variables including any database...

CVE-2025-62402

API users via /api/v2/dagReports could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available...

Apache Airflow security vulnerabilities

Apache Airflow is a set of open source platforms with the ability to create, manage and monitor workflows from the US Apache Apache Foundation. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow, which stems from the...