CVE-2026-102628
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessib
CVSS
9.3
Crítico
EPSS
0.3%
p25
KEV
—
Exploit Today
8
0-100
Publicado: 1 oct 2026 · Última mod.: 11 oct 2026 · CWE-215 · CWE-489
0.3%EPSS · 30 días0.3%
2026-10-022026-10-19
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.
- raw.githubusercontent.comhttps://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-275-05.json
- www.cve.orghttps://www.cve.org/CVERecord?id=CVE-2026-102628
- xhunter101.medium.comhttps://xhunter101.medium.com/how-i-discovered-cve-2026-102628-from-a-whois-lookup-to-a-cisa-cve-635835fa3971
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1121905.3 MED—
——0A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.1dCVE-2026-155755.3 MED8.9%
——3Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces.
This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.4dCVE-2026-22061—1.3%
——0Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials.4dCVE-2026-835507.1 ALT10.3%
——3A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from heap dumps. Additionally, repeated CPU profiling through these endpoints can lead to a denial of service.13dCVE-2026-100102—27.9%
——8Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.14dCVE-2026-205435.5 MED1.9%
——1In Modem, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01645293; Issue ID: MSV-6761.12d