83977 matches found
CVE-2026-57443
SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call thi...
CVE-2026-100379
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main...
CVE-2026-100377
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the master branch...
UBUNTU-CVE-2026-91766
When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore...
CVE-2026-100379
The Wikipedia Android App (main component) is vulnerable to an Exposure of Sensitive Information flaw. This vulnerability allows an unauthorized actor to access, intercept, or modify HTTP cookies , specifically resulting in the cross-request disclosure of CentralAuth cookies . No specific exploit...
EUVD-2026-87344
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Wikipedia Android App allows Accessing/Intercepting/Modifying HTTP Cookies. This issue affects Wikipedia Android App: main...
CVE-2026-100377
The Wikimedia Foundation Mediawiki - WikiLambda Extension (version 1.47.0-alpha ) is vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. This flaw allows revision-deleted pages to be viewed through the extension's action=edit and Special:ViewAbstract functio...
CVE-2026-100377 Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the master branch...
EUVD-2026-87358
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the master branch...
CVE-2026-100377 Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - WikiLambda Extension allows Excavation. This issue affects Mediawiki - WikiLambda Extension: 1.47.0-alpha. The issue has been remediated on the master branch...
CVE-2026-57443 SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrowser API server scripts/aetherbrowser/apiserver.py exposes the POST /api/ops/check-email endpoint without any authentication. Any remote attacker can call thi...
CVE-2026-5267
Ciena Navigator Network Control Suite NCS contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive...
CVE-2026-96879
The Mediawiki - FlaggedRevs extension (up to version 1.46.0 ) from the Wikimedia Foundation is vulnerable to the improper removal of sensitive information before storage or transfer. Specifically, the "Checked by" label in page history may be displayed even when the underlying review log entry is...
CVE-2026-63208
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...
CVE-2026-100192
X-SpringBoot through 6.0 exposes appKey and appSecret credentials in the GET /application/manager/select endpoint without authentication or field filtering. Unauthenticated attackers can retrieve these credentials and use them to send arbitrary SMS messages through any tenant's SMS provider,...
CVE-2026-5267
The Ciena Navigator Network Control Suite (NCS) is affected by an information exposure vulnerability in its event-streaming API . The root cause is a failure to properly enforce authentication , which allows an unauthenticated attacker with network access to the affected service to access the eve...
CVE-2026-5267 Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS
Ciena Navigator Network Control Suite NCS contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive...
EUVD-2026-87295
Ciena Navigator Network Control Suite NCS contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive...
CVE-2026-5267 Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS
Ciena Navigator Network Control Suite NCS contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive...
CVE-2026-63208 Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...