#cwe-200

共收录 1778 条相关情报。

漏洞预警2026-08-01 发布INFO

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` method in ...

CVE-2026-2916

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-31 发布MEDIUM

gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read an...

CVE-2026-54785

CVE-2026-54785 影响 gemini-bridge 这款轻量级 MCP（Model Context Protocol）服务器，其作用是通过官方 CLI 将 AI 代理连接到 Google 的 Gemini AI 服务。在版本 1

历史摘要 · 未重新核验 · NVD

#cve #cwe-22 #cwe-200

漏洞预警2026-07-31 发布MEDIUM

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_your_data flow requires the ...

CVE-2026-45377

Decidim 是一个开源参与式民主框架，用于城市或组织的公民参与流程。其数据下载功能（download_your_data）存在一个身份验证绕过漏洞（CVE-2026-45377）。在受影响的版本（0.30.9 之前，0.31.0 至 0

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-284

安全公告2026-07-31 发布INFO

gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode

CVE-2026-54785

### Summary `consult_gemini_with_files` in **inline mode** read any file path supplied in the `files` argument without c

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #pip #cwe-22 #cwe-200 #severity:medium

漏洞预警2026-07-31 发布INFO

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to pre...

CVE-2026-55824

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth cre

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

安全公告2026-07-31 发布INFO

Contao crawler leaks auth credentials to external hosts

CVE-2026-55824

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth cre

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200

漏洞预警2026-07-31 发布INFO

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file template...

CVE-2026-52855

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-522

安全公告2026-07-31 发布INFO

Wings exposes node configuration secrets through egg configuration-file templating

CVE-2026-52855

### Impact **Type:** Exposure of sensitive information / insufficiently protected credentials leading to privilege esca

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-200 #cwe-522 #severity:critical

安全公告2026-07-31 发布INFO

Wings exposes node configuration secrets through egg configuration-file templating

CVE-2026-52855

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-522

漏洞预警2026-07-31 发布INFO

The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session ...

CVE-2026-15048

The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowin

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-31 发布INFO

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing...

CVE-2026-14931

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-31 发布INFO

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allow...

CVE-2026-14928

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning supp

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-31 发布INFO

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to re...

CVE-2026-14319

The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurri

历史摘要 · 未重新核验 · NVD

#cve #cwe-200

漏洞预警2026-07-31 发布INFO

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes...

CVE-2026-55496

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActi

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-359

安全公告2026-07-31 发布INFO

Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicate

CVE-2026-55496

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActi

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-359

漏洞预警2026-07-30 发布INFO

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.title and _...

CVE-2026-67529

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /ap

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-862

安全公告2026-07-30 发布INFO

OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)

CVE-2026-67529

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /ap

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-200 #cwe-862

漏洞预警2026-07-29 发布INFO

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In 6.0.0 and earlier, the redfish-* plugins built request U...

CVE-2026-67436

Linuxfabrik monitoring-plugins provides Python monitoring plugins for Icinga, Nagios, and related monitoring systems. In

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-200 #cwe-918

漏洞预警2026-07-29 发布INFO

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 6.0.0, lib.url.fetch() followed cross-origin redire...

CVE-2026-67435

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to ve

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-918

漏洞预警2026-07-29 发布INFO

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degener...

CVE-2026-13697

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 an

历史摘要 · 未重新核验 · NVD

#cve #cwe-200 #cwe-248 #cwe-525