Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API c...

CVE-2026-62988

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Adm

历史摘要 · 未重新核验 · NVD

Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

CVE-2026-62988

## Summary Several Froxlor API command classes return sensitive authentication material in JSON API responses. The affe

历史摘要 · 未重新核验 · GitHub Advisory

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the tcp_actions() function

CVE-2026-52481

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via t

历史摘要 · 未重新核验 · NVD

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes eve...

CVE-2026-63640

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the ca

历史摘要 · 未重新核验 · NVD

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before ...

CVE-2026-75915

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fa

历史摘要 · 未重新核验 · NVD

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the Link storage struc...

CVE-2026-62684

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

历史摘要 · 未重新核验 · NVD

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environmen...

CVE-2026-69189

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLH

历史摘要 · 未重新核验 · NVD

Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird...

CVE-2026-74972

Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ES

历史摘要 · 未重新核验 · NVD

Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thu...

CVE-2026-74971

Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Fi

历史摘要 · 未重新核验 · NVD

ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints (GetClusterHandler...

CVE-2026-75839

ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerabil

历史摘要 · 未重新核验 · NVD

Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating...

CVE-2026-75587

Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, w

历史摘要 · 未重新核验 · GitHub Advisory

Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diag...

CVE-2026-75587

Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, w

历史摘要 · 未重新核验 · NVD

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content fr...

CVE-2026-42164

Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a cert

历史摘要 · 未重新核验 · NVD

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's...

CVE-2026-71424

Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/ser

历史摘要 · 未重新核验 · NVD

The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Visiting a ...

CVE-2026-64778

The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS

历史摘要 · 未重新核验 · NVD

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. An app may be able to leak sensitive kernel state.

CVE-2026-64760

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10.

历史摘要 · 未重新核验 · NVD

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/...

CVE-2026-57485

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /

历史摘要 · 未重新核验 · NVD

vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

# NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sib

历史摘要 · 未重新核验 · GitHub Advisory

Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

CVE-2026-68520

## Summary Glances provides `as_dict_secure()` explicitly designed for unauthenticated API access, with a docstring sta

历史摘要 · 未重新核验 · GitHub Advisory

siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability...

CVE-2026-73047

siyuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view

历史摘要 · 未重新核验 · GitHub Advisory