CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
WebDyne Perl Framework Source Code & Credentials Disclosure Vulnerability (CVE-2026-78192) Analysis and Mitigation Guide
[Affected Scope] WebDyne versions from 2.022 before 3.022 for Perl
[Impact] Unauthenticated remote attackers can read application source code (.psp, .pm, .pl) and extract hardcoded credentials via the default index page viewer
[Mitigation] Immediately upgrade WebDyne to version 3.022 or later
TeleMessage Service Spring Boot Actuator Heap Dump (/heapdump) Exposure Information Disclosure Vulnerability (CVE-2025-48927)
[Affected Scope] TeleMessage service deployments through 2025-05-05
[Impact] Unauthenticated remote attackers can download the JVM heap dump via the exposed /heapdump endpoint, leading to the extraction of sensitive credentials, API keys, and user data from memory
[Mitigation] Disable the heapdump Actuator endpoint immediately, restrict external access via reverse proxies/WAFs, and rotate all potentially compromised credentials
Unitronics VisiLogic and Vision/Samba PLC Hardcoded Default Administrative Password Vulnerability (CVE-2023-6448) Security Advisory
[Affected Scope] Unitronics Vision and Samba PLCs and HMIs configured using VisiLogic versions prior to 9.9.00
[Impact] Unauthenticated remote attackers with network access can exploit default administrative credentials to gain full control of the target system
[Mitigation] Upgrade VisiLogic to version 9.9.00 or later, change default passwords immediately, and restrict external network exposure
Apache Superset Session Validation Bypass and Remote Code Execution via Default SECRET_KEY (CVE-2023-27524)
[Affected Scope] Apache Superset installations up to and including version 2.0.1 that have not altered the default configured SECRET_KEY.
[Impact] Unauthorized attackers can forge session cookies to authenticate as administrators, leading to unauthorized resource access, database compromise, and potential Remote Code Execution (RCE).
[Mitigation] Immediately configure a unique, cryptographically strong, randomly generated SECRET_KEY in 'superset_config.py' or via environment variables.