Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafte...

CVE-2026-7999

Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potential

历史摘要 · 未重新核验 · NVD

Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. A crafted request to the router web interface can expose sensitive device and ...

CVE-2026-34474

Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. A crafted request to

历史摘要 · 未重新核验 · NVD

AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization

CVE-2026-43885

### Summary An unauthenticated user can read `APISecret` from `objects/plugins.json.php` and use it to call protected

历史摘要 · 未重新核验 · GitHub Advisory

Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback

CVE-2026-42220

## Summary An authenticated user can call `GET /api/settings` and retrieve sensitive configuration values, including `no

历史摘要 · 未重新核验 · GitHub Advisory

Prometheus Azure AD remote write OAuth client secret exposed via config API

CVE-2026-42151

### Impact Users who use Azure AD remote write with OAuth authentication are impacted. The `client_secret` field in th

历史摘要 · 未重新核验 · GitHub Advisory

The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the write_mem (ioctl 0x89...

CVE-2026-36355

The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perfo

历史摘要 · 未重新核验 · NVD

The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized...

CVE-2026-4409

The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leak

历史摘要 · 未重新核验 · GitHub Advisory

The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leaked secret key and usage of a weak hash generation algorit...

CVE-2026-4409

The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leak

历史摘要 · 未重新核验 · NVD

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all settings structs t...

CVE-2026-42223

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/sett

历史摘要 · 未重新核验 · NVD

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, ...

CVE-2026-42220

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /a

历史摘要 · 未重新核验 · NVD

quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations

CVE-2026-42333

### Summary The generated authentication filter matches OpenAPI path templates too broadly when deciding whether to att

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs

## Summary Exec allowlist analysis rejects shell expansion in unquoted heredocs. ## Affected Packages / Versions - Pack

历史摘要 · 未重新核验 · GitHub Advisory

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configura...

CVE-2026-42151

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_

历史摘要 · 未重新核验 · NVD

titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authent...

CVE-2026-42092

titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all glo

历史摘要 · 未重新核验 · NVD

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is...

CVE-2026-3504

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Infor

历史摘要 · 未重新核验 · GitHub Advisory

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3...

CVE-2026-3504

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Infor

历史摘要 · 未重新核验 · NVD

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of...

CVE-2025-14726

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of

历史摘要 · 未重新核验 · GitHub Advisory

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustinde...

CVE-2025-14726

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of

历史摘要 · 未重新核验 · NVD

CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.50. Attackers with control of a modified server can forc...

CVE-2026-33448

CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.

历史摘要 · 未重新核验 · NVD

Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability in MeWare Software Development Inc. P...

CVE-2026-7382

Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized

历史摘要 · 未重新核验 · NVD