CVE-2026-102628

CriticalCVSS 9.3/10Last modified Oct 11, 2026

Description

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-215 CWE-489

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2026
Last modified: Oct 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-102637.3A vulnerability was found in SourceCodester Computer Repair Shop Management System up to 1.0. Affected is an unknown function of the file /a CVE-2026-1026304.7UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, all CVE-2026-1026315.9In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped CVE-2026-1026335.9libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computi CVE-2026-1026347.5SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Moo CVE-2026-1026355.3ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension h CVE-2026-1026396.5MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic t CVE-2026-102643.5A vulnerability was determined in lharries whatsapp-mcp 0.0.1. Affected by this vulnerability is the function SendMessageRequest of the file CVE-2026-102656.3A vulnerability was identified in itsourcecode Content Management System 1.0. Affected by this issue is some unknown functionality of the fi CVE-2026-1026634.3OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware CVE-2026-1026666.5The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST AP CVE-2026-1026678.3Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permi