hashi-vault-js: Vault token and secret values exposed in thrown errors
CVE-2026-55102
## Summary Vault token and secret values are exposed in thrown errors when using `hashi-vault-js`. ## Details Every A
#severity:medium
共收录 5494 条相关情报。
← 返回所有主题ep_etherpad-lite: Device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext author token
CVE-2026-55088
Etherpad's device-to-device author-token transfer endpoint is replayable, never expires, and exposes the cleartext autho
ep_etherpad-lite: Import/export uses Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwrite
CVE-2026-55086
## Description `src/node/handler/ImportHandler.ts` and `src/node/handler/ExportHandler.ts` both compute their temporary
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
CVE-2026-55087
# GHSA-03 — `x-proxy-path` header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving...
CVE-2026-71194
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOT
The web interface of the affected device relies on the HTTP referrer header as part of request...
CVE-2026-15141
The web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests con
IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0...
CVE-2026-7366
IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower G
A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole...
CVE-2026-71846
A flaw was found in insights-client. The component's ServiceAccount is bound to a ClusterRole granting cluster-wide secr
A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local...
CVE-2026-18726
A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a
A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer...
CVE-2026-18727
A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds
A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An...
CVE-2026-19130
A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0...
CVE-2026-17616
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Ident
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when...
CVE-2026-19502
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, t
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes...
CVE-2026-18097
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the...
CVE-2026-19503
MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpo
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization...
CVE-2026-16480
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the c
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0...
CVE-2026-11932
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Ident
A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an...
CVE-2026-73433
A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_
SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure...
CVE-2026-72808
SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the...
CVE-2026-72806
SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter tha