Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership...

CVE-2026-56843

Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated custo

历史摘要 · 未重新核验 · NVD

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder open app` opens external work...

CVE-2026-55431

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

历史摘要 · 未重新核验 · NVD

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

CVE-2026-55431

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7,

历史摘要 · 未重新核验 · OSV.dev

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect...

CVE-2026-7017

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server

历史摘要 · 未重新核验 · GitHub Advisory

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Lo...

CVE-2026-7017

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server

历史摘要 · 未重新核验 · NVD

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets

CVE-2026-7017

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server

历史摘要 · 未重新核验 · OSV.dev

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleDeployment.spec.opt...

CVE-2026-44938

A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from na

历史摘要 · 未重新核验 · NVD

Coder's session token leaked to arbitrary hosts via `coder open app` for external workspace apps

CVE-2026-55431

### Summary `coder open app` opens external workspace-app URLs without validating the scheme or host. When an external

历史摘要 · 未重新核验 · GitHub Advisory

uniFLOW Universal Login Manager (ULM) Standalone contains an information disclosure vulnerability that may allow an authenticated administrator to access sensitive configuration...

CVE-2026-1433

uniFLOW Universal Login Manager (ULM) Standalone contains an information disclosure vulnerability that may allow an auth

历史摘要 · 未重新核验 · NVD

LaunchServer FileServerHandler has an unauthenticated path traversal issue

CVE-2026-54617

### Summary An unauthenticated path traversal in the LaunchServer HTTP file server (`FileServerHandler`) lets any remote

历史摘要 · 未重新核验 · GitHub Advisory

OpenClaw MCP SSE redirects could forward Authorization headers

### Summary MCP SSE redirects could forward Authorization headers. In affected versions, a lower-trust caller or config

历史摘要 · 未重新核验 · GitHub Advisory

ORAS Go forwards registry credentials across registry redirects

# ORAS Go forwards registry credentials across registry redirects Reporter / public credit: JUNYI LIU ## Summary ORAS

历史摘要 · 未重新核验 · GitHub Advisory

Fleet has PSS Bypass through addLabelsFromOptions in Fleet Agent

CVE-2026-44938

### Impact A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive k

历史摘要 · 未重新核验 · GitHub Advisory

Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security...

CVE-2026-14019

Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cros

历史摘要 · 未重新核验 · NVD

Parseable before 2.9.2 contains an information disclosure vulnerability in the notification...

CVE-2026-56783

Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that re

历史摘要 · 未重新核验 · GitHub Advisory

Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that returns webhook tokens and basic-auth credentials in cleart...

CVE-2026-56783

Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that re

历史摘要 · 未重新核验 · NVD

Information exposure vulnerability in Hitachi Storage Navigator. This issue affects Hitachi Virtual Storage Platform 5100, 5200, 5500, 5600, 5100H, 5200H, 5500H, 5600H, VX8: be...

CVE-2025-7386

Information exposure vulnerability in Hitachi Storage Navigator. This issue affects Hitachi Virtual Storage Platform 51

历史摘要 · 未重新核验 · NVD

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

CVE-2026-55180

## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expec

历史摘要 · 未重新核验 · GitHub Advisory

pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

CVE-2026-50017

## Summary pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local

历史摘要 · 未重新核验 · GitHub Advisory

regclient may leak authentication credentials to external blob stores

CVE-2026-49349

Credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a maliciou

历史摘要 · 未重新核验 · GitHub Advisory