AshAi echoes raw tool exception messages into the conversation, disclosing internal details
CVE-2026-82580
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal erro
#cwe-209
共收录 131 条相关情报。
← 返回所有主题Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that an application con...
CVE-2026-78693
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote cl
Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names
CVE-2026-78693
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote cl
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 -...
CVE-2026-59271
When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, gorou...
CVE-2026-79777
rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger p
The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy learned MAC Addre...
CVE-2026-8173
The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an aut
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fixed in version 3.2.3.
CVE-2026-33333
Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the
NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution
## Executive Summary Two vulnerabilities were identified and chained to achieve authenticated remote code execution Th
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the n...
CVE-2026-77076
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. Wh
SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses
### Summary mcp-searxng version 1.11.0 exposes SearXNG Basic Authentication credentials embedded in the `SEARXNG_URL` e
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in custom_components/blueprint_studi...
CVE-2026-53458
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio
Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling
Fix: PR #7906 (ether/etherpad). A set of medium/low hardening fixes: - **Weak RNG for tokens (CWE-330):** author/sessio
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the cal...
CVE-2026-73844
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream respon
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI ...
CVE-2026-73555
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in
vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages
CVE-2026-73555
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in
hashi-vault-js: Vault token and secret values exposed in thrown errors
CVE-2026-55102
## Summary Vault token and secret values are exposed in thrown errors when using `hashi-vault-js`. ## Details Every A
HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.
CVE-2026-56620
HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error repor
llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot s...
CVE-2026-43630
llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore p
llama.cpp b5702–b7653 Out-of-Bounds Read Information Disclosure
CVE-2026-43630
llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore p
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of...
CVE-2026-47622
NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that con