Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resou...

CVE-2026-49288

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Con

历史摘要 · 未重新核验 · NVD

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.

CVE-2026-12620

The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects G

历史摘要 · 未重新核验 · NVD

Exposure of sensitive information to an unauthorized actor in Cost Management Interactive...

CVE-2026-47633

Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthor

历史摘要 · 未重新核验 · GitHub Advisory

Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthorized attacker to disclose information over a network.

CVE-2026-47633

Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthor

历史摘要 · 未重新核验 · NVD

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.4.01. This is due to insufficient autho...

CVE-2026-12111

The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to,

历史摘要 · 未重新核验 · NVD

The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.7 via...

CVE-2026-12120

The FireBox Popups – Increase Sales and Grow Your Email List plugin for WordPress is vulnerable to Sensitive Information

历史摘要 · 未重新核验 · NVD

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.7.5 v...

CVE-2026-11357

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Informati

历史摘要 · 未重新核验 · NVD

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint prior to version 4.2...

CVE-2026-50200

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

历史摘要 · 未重新核验 · NVD

Langflow: Unauthenticated file upload leads to DoS (space exhaustion) and information leak

CVE-2026-55450

### Summary Unauthenticated users can upload any amount of data to the server without any limitations. No need for any p

历史摘要 · 未重新核验 · GitHub Advisory

Claude Code: Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch

CVE-2026-54316

Because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—i

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw: MCP Streamable HTTP redirects could forward configured custom headers to another origin

CVE-2026-53840

### Summary OpenClaw supports remote MCP Streamable HTTP servers with operator-configured custom headers. In affected r

历史摘要 · 未重新核验 · GitHub Advisory

n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host

CVE-2026-54304

## Impact An authenticated user with permission to create or modify workflows and access to a SecurityScorecard credenti

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints

CVE-2026-54305

## Impact Three EE endpoints used by the Dynamic Credentials feature accepted any authenticated n8n session without perf

历史摘要 · 未重新核验 · GitHub Advisory

Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5...

CVE-2026-12117

Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated

历史摘要 · 未重新核验 · GitHub Advisory

Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to...

CVE-2026-12117

CVE-2026-12117 是 Devolutions Server 2026.2.5 版本中社会登录连接端点存在的一个不当访问控制漏洞。该漏洞允许经过身份验证的保管人（vault member）通过构造特制的 API 请求，列举其未被授

历史摘要 · 未重新核验 · NVD

Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

CVE-2026-12320

Information disclosure in the Password Manager component. This vulnerability was fixed in Firefox 152 and Thunderbird 15

历史摘要 · 未重新核验 · NVD

Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thund...

CVE-2026-12311

Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Fi

历史摘要 · 未重新核验 · NVD

Nuxt: Dev server discloses project absolute path and persistent workspace UUID via `/.well-known/appspecific/com.chrome.devtools.json`

### Summary When running `nuxt dev`, Nuxt registers an unauthenticated route at `/.well-known/appspecific/com.chrome.de

历史摘要 · 未重新核验 · GitHub Advisory

Netty: QUIC stateless reset token material exposed through header-visible connection IDs

CVE-2026-50009

### Summary Netty QUIC exposes the stateless reset token on the network path when using the default HMAC-based connectio

历史摘要 · 未重新核验 · GitHub Advisory

Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

# CurlAsyncHTTPClient leaks per-request credentials on handle reuse ## Summary `CurlAsyncHTTPClient` pools and reuses

历史摘要 · 未重新核验 · GitHub Advisory