CRITICAL 9.2 NVD

CVE-2026-102628

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An u

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.

References

Published: 2026-10-01 · Source: NVD · Feed updated: 2026-10-01

This critical severity vulnerability with a CVSS score of 9.2 was published on 2026-10-01 via NVD.

Risk Timeline

CVE Disclosed2026-10-01 · -1 days ago

Remediation Resources

Official Advisory

www.cve.org/CVERecord?id=CVE-2026-102628

Analysis & PoC

raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/202

vulnfeed aggregates 9446 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.