Information Exposure

Overview sglang is a SGLang is a fast serving framework for large language models and vision language models. Affected versions of this package are vulnerable to Information Exposure via the /serverinfo endpoint when only the --admin-api-key is configured. An attacker can obtain sensitive API key...

CVE-2026-15746: Server-Side Request Forgery (SSRF)

Strands Agents is an open-source Python SDK for building and running AI agents. The strands-agents-tools package provides pre-built tools for use with the SDK, including the elasticsearchmemory tool for agent memory storage. We identified CVE-2026-15746, a server-side request forgery SSRF issue i...

Directory Traversal

Overview netlicensing-mcp is a MCP server for the Labs64 NetLicensing license management API Affected versions of this package are vulnerable to Directory Traversal via the getproduct function. An attacker can access sensitive API key values and shop URLs in plaintext by supplying a crafted...

WordPress Fortis For WooCommerce plugin < 1.3.1 - Sensitive API Key Disclosure vulnerability

Sensitive API Key Disclosure vulnerability discovered by WPScan Team in WordPress Plugin Fortis for WooCommerce versions 1.3.1...

CVE-2025-13997 King Addons for Elementor <= 51.1.49 - Unauthenticated API Keys Disclosure

The King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in all versions up to, and including, 51.1.49 due to the plugin adding the API keys to the HTML source code via...

CVE-2025-13997: Exposure of Sensitive Information to an Unauthorized Actor

The King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in all versions up to, and including, 51.1.49 due to the plugin adding the API keys to the HTML source code via...

EUVD-2023-44412

Malicious code in bioql PyPI...

EUVD-2023-44344

Malicious code in bioql PyPI...

CVE-2024-28088

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

CVE-2023-3779

The Essential Addons For Elementor plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 5.8.1 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possible for unauthenticated attackers...

CVE-2023-6777

The WP Go Maps formerly WP Google Maps plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 9.0.34 due to the plugin adding the API key to several plugin files. This makes it possible for unauthenticated attackers to obtain the developer's...

CVE-2024-34897

Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability...

CVE-2024-34897

Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability...

CVE-2024-34897

Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability...

CVE-2024-34897

The Nedis SmartLife android app, specifically version v1.4.0 , is vulnerable to an API key disclosure vulnerability. This flaw may allow an unauthorized actor to access sensitive information or interact with the service using the exposed keys. There is currently no information regarding a newer v...

CVE-2024-34897: Exposure of Sensitive Information to an Unauthorized Actor

Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability...

PT-2024-28010

Name of the Vulnerable Software and Affected Versions Avalara for Salesforce CPQ versions prior to 7.0 Description The issue allows attackers to read an API key. The current version of the app is 11 as of mid-2024. Recommendations For versions prior to 7.0, update to version 7.0 or later to resol...

CVE-2024-37895

Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. This issu...

PT-2024-27816

Name of the Vulnerable Software and Affected Versions Lobe Chat versions prior to 0.162.25 Description The issue allows an attacker to obtain the real backend API Key if they can successfully authenticate through SSO/Access Code. This is achieved by modifying the base URL to their own attack URL ...

PT-2024-26239

Name of the Vulnerable Software and Affected Versions Nedis SmartLife android app version 1.4.0 Description The issue concerns an API key disclosure. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited...