CVE-2026-78062High· 7.3▾ TwilightA vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to hard-coded credentials. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-14126High· 8.8A vulnerability has been found in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06
CVE-2026-112146High· 7.4D-Link E15/M32/R15/R32 MQTT Broker passwd hard-coded credentials
CVE-2026-110667High· 7.3A security flaw has been discovered in cemtan sar2html 4.0.0
CVE-2026-108831Medium· 6.3A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2
CVE-2026-108584Medium· 5.3A security flaw has been discovered in FunnyWolf Viper up to 3.1.11
CVE-2026-105147High· 7.3A vulnerability was determined in SciPhi-AI R2R up to 3.6.6