Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security se...

CVE-2026-78896

Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-o

历史摘要 · 未重新核验 · NVD

Information leak in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVE-2026-78895

Information leak in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy

历史摘要 · 未重新核验 · NVD

Information leak in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Me...

CVE-2026-78893

Information leak in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information

历史摘要 · 未重新核验 · NVD

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 t...

CVE-2026-62986

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion pictu

历史摘要 · 未重新核验 · NVD

phpMyFAQ public FAQ APIs expose inactive FAQ content

## Affected Product phpMyFAQ ## Affected Versions - Confirmed affected: 4.1.4, API v3.1. - Confirmed affected: curren

历史摘要 · 未重新核验 · GitHub Advisory

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through f...

CVE-2026-55553

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prio

历史摘要 · 未重新核验 · NVD

urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage

CVE-2026-55553

## Summary urllib supports redirect-following through `followRedirect`, which is expected behavior for an HTTP client.

历史摘要 · 未重新核验 · GitHub Advisory

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host ...

CVE-2026-79780

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, al

历史摘要 · 未重新核验 · NVD

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/p...

CVE-2026-79776

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication ru

历史摘要 · 未重新核验 · NVD

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON serialization tags on the Comment model. Unauthenticated atta...

CVE-2026-79660

Ech0 versions before 4.7.3 expose guest commenter email addresses through public API endpoints due to improper JSON seri

历史摘要 · 未重新核验 · NVD

HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment.

CVE-2026-21758

HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive inf

历史摘要 · 未重新核验 · NVD

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. A...

CVE-2026-72698

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing

历史摘要 · 未重新核验 · NVD

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys...

CVE-2026-78555

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Althoug

历史摘要 · 未重新核验 · GitHub Advisory

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation...

CVE-2026-78555

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Althoug

历史摘要 · 未重新核验 · NVD

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upgrade to version 1....

CVE-2026-75099

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through

历史摘要 · 未重新核验 · NVD

The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (uint32_t data[4]). The builders make_endpoint_info() and ...

CVE-2026-13343

The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (

历史摘要 · 未重新核验 · NVD

RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Location records associated with ransomware groups and markets ...

CVE-2026-78386

RansomLook exposed sensitive operator-side scraping configuration through multiple unauthenticated API responses. Locati

历史摘要 · 未重新核验 · NVD

Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is incorporated into Redis SCAN MATCH p...

CVE-2026-78378

Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlle

历史摘要 · 未重新核验 · NVD

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose, and plugin/Galler...

CVE-2026-59256

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens witho

历史摘要 · 未重新核验 · NVD

AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses b...

CVE-2026-56380

AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthentica

历史摘要 · 未重新核验 · NVD