Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Vertx Websocket compon...

CVE-2026-46726

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF

历史摘要 · 未重新核验 · NVD

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer (MailProducer.getSen...

CVE-2026-46584

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail

历史摘要 · 未重新核验 · NVD

Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based)...

CVE-2026-56646

Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized att

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the...

CVE-2026-14611

A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function initProjectMemory of

历史摘要 · 未重新核验 · GitHub Advisory

Notification API leaks private issue metadata after access revocation

CVE-2026-58419

Notification API leaks private issue metadata after access revocation

历史摘要 · 未重新核验 · NVD

Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-56646

Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized att

历史摘要 · 未重新核验 · NVD

Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

CVE-2026-25038

Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

历史摘要 · 未重新核验 · NVD

Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing data to a fork that should no longer be authorized.

CVE-2026-24451

Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing

历史摘要 · 未重新核验 · NVD

A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function initProjectMemory of the file src/managers/MemoryManager.ts of the component P...

CVE-2026-14611

A vulnerability has been found in DeepMyst Mysti up to 0.4.0. The affected element is the function initProjectMemory of

历史摘要 · 未重新核验 · NVD

In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from any client connected to the standard /services messaging...

CVE-2026-10055

In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC accepts an attacker-controlled URL from

历史摘要 · 未重新核验 · NVD

LaunchServer FileServerHandler has an unauthenticated path traversal issue

CVE-2026-54617

### Summary An unauthenticated path traversal in the LaunchServer HTTP file server (`FileServerHandler`) lets any remote

历史摘要 · 未重新核验 · GitHub Advisory

Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

CVE-2026-50200

### Summary The `Sanitizer` component in the Environment actuator redacts configuration values by matching the configur

历史摘要 · 未重新核验 · GitHub Advisory

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

### Summary `UForm` and `UAuthForm` render a server-side `` element with no `method` and no `action` attribute, relying

历史摘要 · 未重新核验 · GitHub Advisory

Craft CMS is a content management system (CMS). In versions starting from 4.0.0-RC1 and prior to 4.18.0, and 5.0.0-RC1 and above, prior to 5.10.0, the dataUrl() Twig function is...

CVE-2026-55792

Craft CMS 存在一个高危权限漏洞，影响版本 4.0.0-RC1 至 4.18.0 之前以及 5.0.0-RC1 至 5.10.0 之前。漏洞源于 dataUrl() Twig 函数被错误地加入 Twig 沙箱白名单，导致拥有 uti

历史摘要 · 未重新核验 · NVD

OpenClaw MCP SSE redirects could forward Authorization headers

### Summary MCP SSE redirects could forward Authorization headers. In affected versions, a lower-trust caller or config

历史摘要 · 未重新核验 · GitHub Advisory

ORAS Go forwards registry credentials across registry redirects

# ORAS Go forwards registry credentials across registry redirects Reporter / public credit: JUNYI LIU ## Summary ORAS

历史摘要 · 未重新核验 · GitHub Advisory

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, the MNG decoder contains a possible heap...

CVE-2026-53467

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-

历史摘要 · 未重新核验 · NVD

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/Ap...

CVE-2026-58036

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulne

历史摘要 · 未重新核验 · NVD

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Action...

CVE-2026-58033

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulne

历史摘要 · 未重新核验 · NVD

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/...

CVE-2026-58027

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vul

历史摘要 · 未重新核验 · NVD