MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename parameter allows wr...

CVE-2026-53906

MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload

历史摘要 · 未重新核验 · NVD

Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint...

CVE-2026-56331

Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500

历史摘要 · 未重新核验 · GitHub Advisory

Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500 instead of safe 4xx errors when magic_invite_string is in...

CVE-2026-56331

Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500

历史摘要 · 未重新核验 · NVD

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the...

CVE-2025-36328

IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacker to obtain sensitive information w

历史摘要 · 未重新核验 · NVD

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAuth2 HTTP filter's encrypt()/decrypt()...

CVE-2026-47775

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3,

历史摘要 · 未重新核验 · NVD

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost...

CVE-2026-49979

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send

历史摘要 · 未重新核验 · NVD

SurrealDB: Arbitrary file read via DEFINE ANALYZER mapper() filter

SurrealDB's full-text search lets you define a text analyzer whose `mapper` filter loads a term-mapping file from disk (

历史摘要 · 未重新核验 · GitHub Advisory

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.78 and 9.9.1-alpha.2, Parse Server's GraphQL endpoi...

CVE-2026-47248

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

历史摘要 · 未重新核验 · NVD

Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token

CVE-2026-48039

# Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token | Field | Value | | -------------

历史摘要 · 未重新核验 · GitHub Advisory

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP clients through exce...

CVE-2026-40997

Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or dis

历史摘要 · 未重新核验 · NVD

Spring Data REST serializes the full exception cause chain into HTTP error response bodies,...

CVE-2026-41730

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persist

历史摘要 · 未重新核验 · GitHub Advisory

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions:...

CVE-2026-41730

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persist

历史摘要 · 未重新核验 · NVD

Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers

CVE-2026-47248

### Impact Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers through `Did you mean .

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Security Assertion Ma...

CVE-2026-9794

CVE-2026-9794 是 Keycloak 中的一个信息泄露漏洞，影响其 SAML ECP（增强客户端或代理）端点。该漏洞允许远程未认证攻击者通过发送特制的 SOAP 请求并附带不同的客户端 ID，然后观察服务端返回的不同错误信息，从

历史摘要 · 未重新核验 · NVD

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET handlers of the n...

CVE-2026-42459

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to vali

历史摘要 · 未重新核验 · NVD

IBM Business Automation Workflow containers and traditional may leak information about its database structure in error messages.

CVE-2026-1248

IBM Business Automation Workflow containers and traditional may leak information about its database structure in error m

历史摘要 · 未重新核验 · NVD

IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2 could allow a remote attacker to obtain sensitive information when a detailed te...

CVE-2024-28765

IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2 could allow a remote at

历史摘要 · 未重新核验 · NVD

A weakness has been identified in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This impacts an unknown function of the file /index.php of the co...

CVE-2026-9583

A weakness has been identified in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This imp

历史摘要 · 未重新核验 · NVD

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true an...

CVE-2026-45728

Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path

历史摘要 · 未重新核验 · NVD

In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles invalid user input, resulting in limited exposure of diagnostic command...

CVE-2026-5511

In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles invalid user i

历史摘要 · 未重新核验 · NVD