CVE-2026-102628Critical· 9.3▾ MidnightThe Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exc…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 51.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
0.3% → 0.3%
Last analysed / modified upstream
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116820Medium· 5.3YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter
CVE-2026-115727High· 8.1AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server
CVE-2026-112190Medium· 5.3Webkul Aureus ERP composer.json insertion of sensitive information into debugging code
CVE-2026-15575Medium· 5.3Active debug code vulnerability in SFM Software Technologies Inc
CVE-2026-22061High· 8.2Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials.
CVE-2026-83550High· 7.1A flaw was found in postgres-exporter