pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController
CVE-2026-108904
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API client
#cwe-522
共收录 306 条相关情报。
← 返回所有主题Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token and WebDAV password...
CVE-2026-107857
Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile applicati
Vikunja: TOTP secret is readable after enrollment, no step-up auth
CVE-2026-91982
### Summary Once a user has TOTP enabled, the API still hands back the raw shared secret to anyone holding that account'
Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can ...
CVE-2026-39460
Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration fil
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host after an HTTP red...
CVE-2026-107715
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-origin when the host m...
CVE-2026-107714
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_met...
CVE-2026-107399
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin tru
Mechanize sends credential headers to another origin after a meta refresh
CVE-2026-107399
## Summary `mechanize` applied no trust boundary to a `meta` refresh, so credentials set through `Mechanize#request_hea
Mechanize sends credential headers to another host after an HTTP redirect
CVE-2026-107715
## Summary `mechanize` leaked credentials to the redirect target when an HTTP redirect crossed to another host. Credent
Mechanize sends credential headers to another host after an HTTP redirect
CVE-2026-107715
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied
Mechanize sends credential headers to a different scheme or port after a redirect
CVE-2026-107714
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response
Mechanize sends credential headers to another origin after a meta refresh
CVE-2026-107399
The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin tru
Docling: Configured HTTP headers sent to every remote image host named by a document
CVE-2026-105742
### Summary `HTMLBackendOptions.headers` is documented for passing authentication headers (API keys, bearer tokens) whe
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain...
CVE-2026-101331
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.
CVE-2026-101331
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OA...
CVE-2026-104850
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.
MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server
CVE-2026-104850
### Summary In affected versions, the SDK's OAuth client let the MCP server decide which authorization server received t
Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters f...
CVE-2026-105763
Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQ
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource...
CVE-2026-105742
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos
In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which ca...
CVE-2026-86671
In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an