CVE-2026-42092

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. At time of publication no public patch is available.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
May 4, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-420938.7Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queCVE-2026-420954.0bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL.CVE-2026-420968.8Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any CVE-2026-420978.8Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query parameter and send the model nCVE-2026-420988.7Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacCVE-2026-420997.5Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads the pCVE-2026-42109.8A security flaw has been discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325CVE-2026-421007.5Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Denial of Service (DoS) attack to be executed by sendiCVE-2026-42119.8A weakness has been identified in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNSCVE-2026-42129.8A security vulnerability has been detected in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, CVE-2026-421277.5The public dashboard query endpoint does not limit request body size before processing, allowing unauthenticated attackers to trigger excessCVE-2026-421297.7A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach administrative Loki endpoints and read sensi