CVE-2026-8200 Schema validation log messages may not redact user data

When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 version...

qihang-wms SQL注入漏洞

Qihang-WMS is an intelligent warehousing management system developed by Qiliping’s individual developers. Qihang-WMS has a SQL injection vulnerability. This vulnerability stems from the SQL injection vulnerability present in the datascope parameter in the SysDeptMapper.xml file. It may allow...

PT-2026-40809

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in the event and shadow attribute listing endpoints. The affected code accepted order or sort values from request paramete...

The vulnerability of the DICOM image processing tool Grassroots DiCoM allows a malicious individual to gain access to confidential data or cause service interruptions.

The vulnerability of the DICOM image processing tool Grassroots DiCoM lies in its ability to read data beyond the acceptable buffer limits. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data or cause service failures by using a specially created DICOM...

The vulnerability of the WebCodecs component in the Google Chrome web browser allows a perpetrator to access confidential data or cause service failures.

The vulnerability of the WebCodecs component in the Google Chrome web browser is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data or cause service failures through a specially creat...

The vulnerability of the declarative delivery tool for GitOps on Kubernetes Argo CD, related to improper cross-border deletion of critical data, allows a perpetrator to disclose protected information.

The vulnerability of GitOps’ continuous delivery tool for Kubernetes Argo CD relates to improper cross-border deletion of critical data. Exploiting this vulnerability could allow a malicious actor to expose the protected information...

The vulnerability of the Cisco IOS XE operating system, which allows a perpetrator to access confidential information

The vulnerability of the Cisco IOS XE operating system is related to the transmission of critical information in plaintext. Exploiting this vulnerability can allow a remote attacker to gain access to confidential information...

SQLBot 安全漏洞

SQLBot is an intelligent data querying system developed by DataEase, based on large models and RAG techniques. Versions of SQLBot prior to 1.8.0 contained security vulnerabilities. These vulnerabilities stemmed from cross-workpace IDOR and authorization bypasses in the...

The vulnerability of the library that accesses HTTP servers via LibSoup allows a perpetrator to gain access to confidential data or cause service failures.

The vulnerability of the LibSoup library for HTTP servers is related to a countable loss of significance. Exploiting this vulnerability could allow an attacker to gain access to confidential data or cause service failures...

ShellHub 安全漏洞

ShellHub is an open-source remote device access and management platform developed by ShellHub. Versions of ShellHub prior to 0.24.2 contained security vulnerabilities. These vulnerabilities stemmed from the GET /api/devices/:uid request, which returned the complete device object for any...

PT-2026-40775

Exposed Keycloak management service in the Arqit Symmetric Key Agreement Platform enables unauthorized access to sensitive debug information such as metrics and health data. This issue affects Symmetric Key Agreement Platform: before 26.03...

CVE-2026-5773: Exposure of Data Element to Wrong Session

libcurl might in some circumstances reuse the wrong connection for SMBS transfers. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of criteria must be met. Due to a logical error in the...

The vulnerabilities in the Firefox ESR and Firefox web browsers, as well as the Thunderbird email client, allow attackers to gain access to confidential data or cause service interruptions.

The vulnerabilities in the Firefox ESR and Firefox web browsers, as well as the Thunderbird email client, involve exploiting authentication vulnerabilities through phising techniques. Exploiting these vulnerabilities can allow a malicious actor to gain access to confidential data or cause service...

Linux Distros Unpatched Vulnerability : CVE-2025-35979

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient execution for some IntelR Processors within VMX...

PT-2026-40823

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.104.3 ERPNext versions prior to 16.14.0 Description Certain endpoints are susceptible to SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution, allowing an attacker ...

PT-2026-40558

The Broadstreet plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.53.1 via the get sponsored meta AJAX action. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract data from password...

PT-2026-40604

qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file. This vulnerability allows attackers to access sensitive database information, including users' Personally Identifiable Information PII...

The vulnerability of the Ruby programming language’s URI module, the RubyGems package manager, allows attackers to gain access to confidential data.

The vulnerability of the Ruby language’s URI module, as well as the RubyGems package manager system, relates to the exposure of information. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...

CVE-2026-44341

GoJobs is a REST API for a Job Board platform. The application exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access ...

CVE-2026-26289

PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally restricted to administrative permissions only...