Wings exposes node configuration secrets through egg configuration-file templating
CVE-2026-52855
### Impact **Type:** Exposure of sensitive information / insufficiently protected credentials leading to privilege esca
#cwe-522
共收录 306 条相关情报。
← 返回所有主题Wings exposes node configuration secrets through egg configuration-file templating
CVE-2026-52855
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{
SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured.
CVE-2026-15977
SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyf
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have a...
CVE-2026-16553
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any host environment vari...
CVE-2026-67427
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_service.py exposes ...
CVE-2026-67426
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verifica
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from the env...
CVE-2026-67425
Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --...
CVE-2026-54660
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resol
CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorized credential modification, potentially leading to comprom...
CVE-2026-14354
CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorize
Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the ...
CVE-2026-17569
Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only per
File Browser: Share API exposes the password hash and bypass token
CVE-2026-62684
## Summary When a user creates a password-protected share or lists existing shares, the JSON response includes the full
Guzzle: Proxy-Authorization headers can be sent to origin servers
### Impact In affected versions, the built-in cURL handlers (`CurlHandler` and `CurlMultiHandler`) put every first-clas
@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin ...
CVE-2026-48022
@hapi/wreck 是一个 Node.js HTTP 客户端工具库，广泛用于 Web 应用和服务间的 HTTP 通信。在版本 18.1.2 之前，该库存在一个安全漏洞：当跟随跨域重定向（Cross-Origin Redirect）时，虽
@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, ...
CVE-2026-44979
该漏洞影响 @hapi/wreck（一款 Node.js HTTP 客户端实用工具）版本低于 18.1.1。当 @hapi/wreck 遵循 HTTP 3xx 重定向到不同主机时，默认仅剥离 `Authorization` 和 `Cooki
A flaw was found in the authentication configuration endpoint of the keycloak-services component,...
CVE-2026-16104
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engi
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access mana...
CVE-2026-16104
A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engi
OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound...
CVE-2026-62213
OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower
OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation...
CVE-2026-62214
OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-t
OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the...
CVE-2026-62208
OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enab
OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and credentials by fail...
CVE-2026-62214
OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-t