tag
Credential-Theft
LiteLLM Proxy Pre-Authentication SQL Injection via Error-Handling Callback (CVE-2026-42208)
LiteLLM Proxy authenticates API requests by checking that the Authorization: Bearer token starts with sk-. When a caller sends a token that does not start with sk-, that assertion fails — but instead of simply rejecting the request, the raw, unhashed token is…
TNC Toolbox: Web Performance Unauthenticated cPanel Credential Exposure (CVE-2025-12539)
TNC Toolbox: Web Performance is a WordPress plugin that integrates with cPanel to manage caching/performance settings, and stores the cPanel API credentials (hostname, username, API key) it needs for that integration in plaintext files under a predictable,…
RustFS Hardcoded gRPC Authentication Token Leading to Full Node Compromise (CVE-2025-68926)
RustFS's internal cluster/node gRPC service (nodeservice.NodeService) authenticates peer-to-peer RPC calls using a fixed, hardcoded bearer token — the literal string "rustfs rpc" — which is compiled into every RustFS build and cannot be rotated or configured…
pdfmake Server-Side Request Forgery via Unvalidated Document URLs (CVE-2026-26801)
CVE-2026-26801 is a Server-Side Request Forgery vulnerability in pdfmake, a popular Node.js PDF generation library. When a document definition (docDefinition) references remote resources in fields such as images, attachments, or files, pdfmake's…
OpenSTAManager Scadenzario Bulk Operations Error-Based SQL Injection — CVE-2026-24418
OpenSTAManager's bulk-operations handler for the Scadenzario (payment schedule) module accepts an idrecords[] array via POST at /actions.php?idmodule=18. The arrayclean() helper only strips empty values and never validates that elements are integers, so…
OpenSTAManager Prima Nota Error-Based SQL Injection — CVE-2026-24419
The Prima Nota (journal entry) module's add.php reads the iddocumenti GET parameter, splits it on commas with explode(), but never validates that the resulting elements are integers before imploding them back into a SQL IN() clause used to look up…
OpenSTAManager Article Pricing Time-Based Blind SQL Injection — CVE-2026-24416
OpenSTAManager's article pricing AJAX handler (/ajaxcomplete.php?op=getprezzi) builds a UNION SQL query to pull pricing history from invoices and delivery notes. The developer correctly wrapped the idarticolo parameter in the framework's prepare() sanitizer…
Nhost Local MCP Server Unauthenticated CORS Bypass Leading to Full Project Takeover (CVE-2026-34200)
The Nhost CLI's local MCP server, used to let AI agents/tools manage a developer's Nhost project, has no inbound authentication and inherits a permissive Access-Control-Allow-Origin: CORS policy from the underlying mcp-go library. Because the server does not…
Fortinet FortiClient EMS Pre-Auth Bypass — "FortiBleed" (CVE-2026-35616)
CVE-2026-35616 is a pre-authentication bypass in Fortinet FortiClient EMS's certificate-chain authentication handler (certchainauth.py), which trusts the X-SSL-CLIENT-VERIFY header directly without performing real cryptographic validation of the presented…
Squidbleed — Squid Proxy FTP Gateway Out-of-Bounds Heap Read (CVE-2026-47729)
CVE-2026-47729, dubbed "Squidbleed," is an out-of-bounds heap read in Squid Proxy's FTP gateway and FTP directory-listing parser. The bug stems from legacy FTP parsing logic (originally written in 1997 for NetWare-style listings) in FtpGateway.cc, where…
Windows NTLM Hash Disclosure via File Explorer - CVE-2025-24054
CVE-2025-24054 is a zero-click NTLMv2-SSP hash disclosure vulnerability in Windows File Explorer. When a user opens a ZIP archive containing a crafted .searchConnector-ms file, Windows Explorer automatically resolves an embedded UNC path during file preview,…
Jenkins CLI Arbitrary File Read to RCE (CVE-2024-23897)
CVE-2024-23897 is an arbitrary file read vulnerability in the Jenkins CLI command parser. The parser expands arguments that start with @ and can disclose controller-local files to unauthenticated attackers in common deployments. This disclosure can expose…