#cwe-200

共收录 1690 条相关情报。

漏洞预警2026-10-09 发布INFO

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive information

CVE-2026-78795

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-09 发布INFO

The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, all...

CVE-2026-92990

The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-08 发布HIGH

Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.

CVE-2026-83943

Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclo

来源摘录 · NVD

#cve #cwe-200

漏洞预警2026-10-08 发布INFO

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP red...

CVE-2026-107715

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-522

漏洞预警2026-10-08 发布INFO

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host m...

CVE-2026-107714

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-319 #cwe-522

漏洞预警2026-10-08 发布INFO

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_met...

CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin tru

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-522

安全公告2026-10-08 发布INFO

Mechanize sends credential headers to another origin after a meta refresh

CVE-2026-107399

## Summary `mechanize` applied no trust boundary to a `meta` refresh, so credentials set through `Mechanize#request_hea

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #rubygems #cwe-200 #cwe-522 #severity:medium

安全公告2026-10-08 发布INFO

Mechanize sends credential headers to another host after an HTTP redirect

CVE-2026-107715

## Summary `mechanize` leaked credentials to the redirect target when an HTTP redirect crossed to another host. Credent

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #rubygems #cwe-200 #cwe-522 #severity:medium

安全公告2026-10-08 发布INFO

PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

CVE-2026-61426

## Summary The AgentOS server in the `praisonai` TypeScript/npm package ships an insecure default: it binds `0.0.0.0`,

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-200 #cwe-284 #cwe-306 #severity:high

安全公告2026-10-08 发布INFO

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

CVE-2026-60091

## Summary PraisonAI's Async Jobs API enables its API-key middleware **only when `PRAISONAI_JOBS_API_KEY` is set**, so

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-200 #cwe-306 #cwe-367 #cwe-918

安全公告2026-10-08 发布INFO

Mechanize sends credential headers to another host after an HTTP redirect

CVE-2026-107715

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-522

安全公告2026-10-08 发布INFO

Mechanize sends credential headers to a different scheme or port after a redirect

CVE-2026-107714

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-319 #cwe-522

安全公告2026-10-08 发布INFO

Mechanize sends credential headers to another origin after a meta refresh

CVE-2026-107399

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin tru

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-522

漏洞预警2026-10-08 发布INFO

IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During SECRET and API_KEY rotation processing, sensitive credential material i...

CVE-2026-84274

IBM Guardium Data Protection 12.2.2 is affected by a sensitive information exposure vulnerability. During SECRET and API

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-10-07 发布INFO

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

CVE-2026-105748

### Summary docling accepts serialized `DoclingDocument` JSON as an input format (`InputFormat.JSON_DOCLING`, enabled b

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-73 #cwe-200 #severity:medium

安全公告2026-10-07 发布INFO

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain...

CVE-2026-93677

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-200 #severity:high

漏洞预警2026-10-07 发布INFO

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to an unauthorized actor.

CVE-2026-93677

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-10-06 发布INFO

Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: application/atom+xml` header returned the owner's activity f...

CVE-2026-97626

Requesting a user or organization profile page (`GET /{username}`) with an `Accept: application/rss+xml` or `Accept: app

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-863

漏洞预警2026-10-06 发布INFO

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive ...

CVE-2026-106501

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/pl

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-201

漏洞预警2026-10-06 发布INFO

Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper inp...

CVE-2026-106459

Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-918