PT-2026-60649

Name of the Vulnerable Software and Affected Versions clawvet self-hosted API server apps/api versions prior to 0.7.5 Description The software contains a hard-coded fallback JWT JSON Web Token secret in auth.ts and provides it as the default in .env.example. An unauthenticated remote attacker can...

CVE-2026-45334

Kirby CMS (versions < 4.9.1 and

PT-2026-54031

Capgo before 12.128.2 contains unauthenticated security definer RPC functions get user id and get org perm for apikey that expose API key validity oracles and user UUID disclosure. Unauthenticated attackers using the public API key can validate leaked keys, enumerate users and apps, and determine...

EUVD-2026-38749

Capgo before 12.128.2 contains an unsecured images bucket lacking any row level security controls, allowing unauthenticated attackers to read, insert, and delete stored app icons. Remote attackers can exploit this misconfiguration to delete all icons and leak sensitive app IDs and user IDs...

Linux Distros Unpatched Vulnerability : CVE-2025-67857

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in moodle. During anonymous assignment submissions, user identifiers were inadvertently exposed in URLs. This data exposure allows unauthorized...

PT-2025-5378 · Pam · Pam

Name of the Vulnerable Software and Affected Versions: PAM affected versions not specified Description: A specific authentication strategy allows learning the ids of PAM users associated with certain authentication types. Recommendations: At the moment, there is no information about a newer versi...

CVE-2020-8497

In Artica Pandora FMS through 7.42, an unauthenticated attacker can read the chat history. The file is in JSON format and it contains user names, user IDs, private messages, and timestamps...