ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction
CVE-2026-42880
### Summary There is a missing authorization and data-masking gap in Argo CD's ServerSideDiff endpoint that allows an at
#cwe-200
共收录 1929 条相关情报。
← 返回所有主题Vercel: Non-interactive mode includes CLI arguments in suggested command output
CVE-2026-44479
# Summary When the Vercel CLI runs in non-interactive mode (`--non-interactive` or auto-detected AI agent), commands th
Axonflow fixed bugs by implementing multi-tenant isolation and access-control hardening
## Summary Eight independently-filed bug fixes in the v7.1.3 → v7.5.0 release window collectively close a set of multi-
A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. This affects an unknown function of the file /cdemos/echs/api/v2/ of the component Response He...
CVE-2026-8033
A vulnerability has been found in PicoTronica e-Clinic Healthcare System ECHS 5.7. This affects an unknown function of t
Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafte...
CVE-2026-7999
Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potential
Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. A crafted request to the router web interface can expose sensitive device and ...
CVE-2026-34474
Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. A crafted request to
AVideo Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization
CVE-2026-43885
### Summary An unauthenticated user can read `APISecret` from `objects/plugins.json.php` and use it to call protected
Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and restore-based nginx-ui state rollback
CVE-2026-42220
## Summary An authenticated user can call `GET /api/settings` and retrieve sensitive configuration values, including `no
Prometheus Azure AD remote write OAuth client secret exposed via config API
CVE-2026-42151
### Impact Users who use Azure AD remote write with OAuth authentication are impacted. The `client_secret` field in th
The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the write_mem (ioctl 0x89...
CVE-2026-36355
The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perfo
The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized...
CVE-2026-4409
The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leak
The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leaked secret key and usage of a weak hash generation algorit...
CVE-2026-4409
The Subscribe To Comments Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a leak
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/settings/settings.go:24-65) serializes all settings structs t...
CVE-2026-42223
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, the GetSettings API handler (api/sett
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /api/settings and retrieve sensitive configuration values, ...
CVE-2026-42220
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, an authenticated user can call GET /a
quarkus-openapi-generator has overly broad path-parameter matching that sends authentication headers to unintended operations
CVE-2026-42333
### Summary The generated authentication filter matches OpenAPI path templates too broadly when deciding whether to att
OpenClaw's exec allowlist analysis rejects shell expansion in unquoted heredocs
## Summary Exec allowlist analysis rejects shell expansion in unquoted heredocs. ## Affected Packages / Versions - Pack
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configura...
CVE-2026-42151
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_
titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authent...
CVE-2026-42092
titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all glo
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is...
CVE-2026-3504
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Infor
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3...
CVE-2026-3504
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Infor