Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function marked SECURITY DEFINER and executable by the anon role. U...

CVE-2026-56303

Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function m

历史摘要 · 未重新核验 · NVD

Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__

CVE-2026-61454

The Grav Admin2 plugin (getgrav/grav-plugin-admin2) before 2.0.4 embeds a global JavaScript variable window.__GRAV_CONFI

历史摘要 · 未重新核验 · OSV.dev

Capgo - Unauthenticated API Key Metadata Disclosure via SECURITY DEFINER RPC Function

CVE-2026-56303

Capgo before 12.128.2 contains an information disclosure vulnerability in the find_apikey_by_value PostgreSQL function m

历史摘要 · 未重新核验 · OSV.dev

The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure...

CVE-2026-10865

The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,

历史摘要 · 未重新核验 · GitHub Advisory

The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all...

CVE-2026-6801

The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin

历史摘要 · 未重新核验 · GitHub Advisory

The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.5 via the context_blog_modal_popup. This makes it ...

CVE-2026-6801

The Context Blog theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin

历史摘要 · 未重新核验 · NVD

The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.11 via the (template body). This makes...

CVE-2026-10865

The Cost Calculator Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,

历史摘要 · 未重新核验 · NVD

The Mux Video Uploader plugin for WordPress is vulnerable to Sensitive Information Exposure in...

CVE-2026-7544

The Mux Video Uploader plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i

历史摘要 · 未重新核验 · GitHub Advisory

The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to...

CVE-2026-12426

The Members – Membership & User Role Editor Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure

历史摘要 · 未重新核验 · GitHub Advisory

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET /api/v1/ddns and GET /api/v1/notification endpoints retur...

CVE-2026-59155

Nezha Monitoring 是一款自托管的轻量级服务器和网站监控与运维工具。在版本 2.2.5 之前，存在一个信息泄露漏洞：GET /api/v1/ddns 和 GET /api/v1/notification 端点会返回完整的资源对

历史摘要 · 未重新核验 · NVD

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD server mounts Go net/http/pprof handlers under /debug with no...

CVE-2026-55882

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD serv

历史摘要 · 未重新核验 · NVD

TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation

## Description A vulnerability was discovered in TSDProxy where it forwards its internal per-process authentication tok

历史摘要 · 未重新核验 · GitHub Advisory

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client secret on RabbitMQ...

CVE-2026-57219

RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth en

历史摘要 · 未重新核验 · NVD

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table and column metadata without applying the document's acces...

CVE-2026-55664

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, the GET /forms endpoint read table

历史摘要 · 未重新核验 · NVD

Deloitte AI Assist for Customer disclosed some configuration information through public-facing...

CVE-2026-57474

Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accept

历史摘要 · 未重新核验 · GitHub Advisory

Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This information could reduc...

CVE-2026-57474

Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accept

历史摘要 · 未重新核验 · NVD

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available. Prior to 1.11.0, Apprise HTTP-based ...

CVE-2026-59180

Apprise is an open source library which allows you to send a notification to almost all of the most popular notification

历史摘要 · 未重新核验 · NVD

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and ...

CVE-2026-55500

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export

历史摘要 · 未重新核验 · NVD

phpMyFAQ before 4.1.5 applies inconsistent active=yes and publication-date filtering across its public FAQ API endpoints, allowing unauthenticated attackers to retrieve inactive...

CVE-2026-57994

phpMyFAQ before 4.1.5 applies inconsistent active=yes and publication-date filtering across its public FAQ API endpoints

历史摘要 · 未重新核验 · NVD

A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue affects the function BrowserTool._do_navigate of the file agent/tools/browser/browser_tool.py of the compo...

CVE-2026-15329

A vulnerability was found in zhayujie CowAgent up to 2.1.0. This issue affects the function BrowserTool._do_navigate of

历史摘要 · 未重新核验 · NVD