The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of...
CVE-2025-14726
The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of
#cwe-200
共收录 1929 条相关情报。
← 返回所有主题The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustinde...
CVE-2025-14726
The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of
CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.50. Attackers with control of a modified server can forc...
CVE-2026-33448
CVE-2026-33448 is a format string vulnerability in the logging subsystem of Secure Access client for MacOS prior to 14.
Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability in MeWare Software Development Inc. P...
CVE-2026-7382
Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized
Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path...
CVE-2026-7381
Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middle
Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation setting (sendfile ty...
CVE-2026-7381
Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middle
Admidio Leaks Hidden Profile Field Values via Blind Search Oracle in Member Assignment
CVE-2026-41659
## Summary The member assignment DataTables endpoint (`members_assignment_data.php`) includes hidden profile fields (BI
OpenClaw: Webchat audio embedding could read local files without local-root containment
## Impact OpenClaw deployments before `2026.4.15` could embed host-local audio files into webchat responses without app
Fiber's cache middleware default key generator ignores query string, causing response mix-up across distinct query parameters
CVE-2026-30246
### Summary Fiber cache middleware's default key generator uses only `c.Path()` and does not include the query string. A
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows...
CVE-2026-40895
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows
The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the valu...
CVE-2026-25219
The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. Thi
A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, exposing sensitive information suc...
CVE-2025-67805
A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Dat
In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authen...
CVE-2025-15381
In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not p
In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. This could lead to local escalation of privilege with n...
CVE-2026-0025
In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass
In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional...
CVE-2025-48642
In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code. This coul
A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerability allows an authenticated user to gain access to sensitiv...
CVE-2025-9908
A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Streams. This vulnerabilit
A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and ...
CVE-2025-9907
A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerabi
Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or more specific Dags to view import errors generated by other...
CVE-2026-24098
Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or mo
In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the R...
CVE-2025-68438
In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length
KAYSUS KS-WR1200 routers with firmware 107 expose SSH and TELNET services on the LAN interface with hardcoded root credentials (root:12345678). The administrator cannot disable ...
CVE-2025-68718
KAYSUS KS-WR1200 routers with firmware 107 expose SSH and TELNET services on the LAN interface with hardcoded root crede