SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is discl...

CVE-2026-9592

SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user sess

历史摘要 · 未重新核验 · NVD

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens...

CVE-2026-62386

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query

历史摘要 · 未重新核验 · GitHub Advisory

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractB...

CVE-2026-62386

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query

历史摘要 · 未重新核验 · NVD

Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter

CVE-2026-62386

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query

历史摘要 · 未重新核验 · OSV.dev

Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter

CVE-2026-50157

### Description Applications built with the Auth0 Symphony SDK, using the Authorizer security authenticator to protect H

历史摘要 · 未重新核验 · GitHub Advisory

Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Fri...

CVE-2026-54652

Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any aut

历史摘要 · 未重新核验 · NVD

Frigate viewer can read logs exposing admin and camera credentials

CVE-2026-54652

Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any aut

历史摘要 · 未重新核验 · OSV.dev

Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers t...

CVE-2026-58656

Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Cont

历史摘要 · 未重新核验 · NVD

@nuxt/ui: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration

### Summary `UForm` and `UAuthForm` render a server-side `` element with no `method` and no `action` attribute, relying

历史摘要 · 未重新核验 · GitHub Advisory

A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, specifically client_id and client_secret, to be transmitted a...

CVE-2026-10078

A flaw was found in the Quay config-tool's GitLab OAuth validator. This vulnerability causes sensitive credentials, spec

历史摘要 · 未重新核验 · NVD

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. ...

CVE-2026-44883

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used t

历史摘要 · 未重新核验 · NVD

A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager package before 1.0.1-1100 allows local attackers to obtai...

CVE-2026-2237

A use of get request method with sensitive query strings vulnerability in volume encryption of Synology Storage Manager

历史摘要 · 未重新核验 · NVD

HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive data in URLs may expose it through browser history, logs...

CVE-2025-62317

HCL AION is affected by a vulnerability where sensitive information may be included in URL parameters. Passing sensitive

历史摘要 · 未重新核验 · NVD

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/MobileManager/oauth2.php completes an OAuth login by sending an HTTP 302 Location: oau...

CVE-2026-43875

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/MobileManager/oauth2.php comp

历史摘要 · 未重新核验 · NVD

Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers...

CVE-2026-37504

Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyControlle

历史摘要 · 未重新核验 · GitHub Advisory

Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server authentication token is accepted via GE...

CVE-2026-37504

Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyControlle

历史摘要 · 未重新核验 · NVD