Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Serv...

CVE-2026-64643

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr

历史摘要 · 未重新核验 · NVD

Next.js: Unauthenticated Disclosure of Internal Server Function endpoints

CVE-2026-64643

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 thr

历史摘要 · 未重新核验 · OSV.dev

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.

CVE-2026-65434

Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions.

历史摘要 · 未重新核验 · NVD

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup...

CVE-2026-66339

A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches t

历史摘要 · 未重新核验 · GitHub Advisory

Next.js: Unauthenticated disclosure of internal Server Function endpoints

CVE-2026-64643

## Impact In Next.js applications using App Router, Server Actions (`use server`) or `use cache` endpoints can be discl

历史摘要 · 未重新核验 · GitHub Advisory

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

### Summary `Repo.clone_from()` passes the caller-supplied remote URL through `Git.polish_url()`, which on every non-Cyg

历史摘要 · 未重新核验 · GitHub Advisory

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings ...

CVE-2026-12547

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When th

历史摘要 · 未重新核验 · NVD

Guzzle: URI fragments disclosed in redirect Referer headers

### Impact When the optional `referer` redirect setting is enabled, affected versions of `RedirectMiddleware` can copy

历史摘要 · 未重新核验 · GitHub Advisory

Guzzle: Host-only cookie scope is not preserved

### Impact In affected versions, `CookieJar` does not preserve whether a response cookie was set without a `Domain` att

历史摘要 · 未重新核验 · GitHub Advisory

Guzzle: Proxy-Authorization headers can be sent to origin servers

### Impact In affected versions, the built-in cURL handlers (`CurlHandler` and `CurlMultiHandler`) put every first-clas

历史摘要 · 未重新核验 · GitHub Advisory

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP...

CVE-2026-13380

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthent

历史摘要 · 未重新核验 · GitHub Advisory

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these re...

CVE-2026-13380

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthent

历史摘要 · 未重新核验 · NVD

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and di...

CVE-2026-54171

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip add

历史摘要 · 未重新核验 · NVD

Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data. This issue affects E-Commerce: throu...

CVE-2026-7488

Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embed

历史摘要 · 未重新核验 · NVD

Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs. This i...

CVE-2026-7189

Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessin

历史摘要 · 未重新核验 · NVD

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized...

CVE-2026-44970

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_call

历史摘要 · 未重新核验 · NVD

dbt-mcp: All MCP Tool Arguments Including Raw SQL and --vars Credentials Transmitted to dbt Labs Telemetry by Default Without Redaction

CVE-2026-44970

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_call

历史摘要 · 未重新核验 · OSV.dev

HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system.

CVE-2026-56460

HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API respons

历史摘要 · 未重新核验 · NVD

Insertion of sensitive information into sent data vulnerability in Sayax Energy Technologies Inc. OSOS allows Authentication Bypass. This issue affects OSOS: through 09072026. ...

CVE-2026-1365

Insertion of sensitive information into sent data vulnerability in Sayax Energy Technologies Inc. OSOS allows Authentica

历史摘要 · 未重新核验 · NVD

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.

CVE-2026-42505

Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of

历史摘要 · 未重新核验 · NVD