Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.
CVE-2026-116861
Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.
#cwe-201
共收录 216 条相关情报。
← 返回所有主题Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.
CVE-2026-115947
Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.
Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer I...
CVE-2026-119564
Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site edit
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two F...
CVE-2026-107268
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM sessi...
CVE-2026-45049
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`C
Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue a...
CVE-2026-48200
Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-
Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.
CVE-2026-118083
Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read produ...
CVE-2026-114173
The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefron
Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Retrieve Embedded Sensitive Data.This iss...
CVE-2026-115591
Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-s
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked wit...
CVE-2026-116689
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16
Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache...
CVE-2026-114190
Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespee
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user vi...
CVE-2026-114485
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlie
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an un...
CVE-2026-105777
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age value...
CVE-2026-87863
An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later f
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS poli...
CVE-2026-87862
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequen
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, le...
CVE-2026-87861
When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previous
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a tran...
CVE-2026-86415
libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel req...
CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) t
@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)
CVE-2026-111753
An incomplete fix for [GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37)
When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second o...
CVE-2026-86413
When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl coul