CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

CVE-2026-105138

The Obot platform versions 0.12.0 before 0.26.2 is vulnerable to a credential exposure flaw in the MCP Catalog Entry API . Due to insufficiently protected credentials, authenticated basic users with access to an entry can perform a GET request to /api/all-mcps/entries/{entry_id}. This action allo...

CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

WordPress QA Analytics plugin <= 5.3.0.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin QA Analytics versions = 5.3.0.0...

ES-File-Explorer-Open-Port-Vulnerability---CVE-2019-6447

此存储库没有 README。...

CVE-2022-37177

CVE-2022-37177 - HireVue-Broken-Or-Risky-Cryptographic-Algorithm 当访问 HireVue 为面试提供的面试邀请链接时，你会被引导到一个条款页面，在开始录制并计时的面试过程之前，你需要先同意这些条款。这个初始 HTTP 响应中包含了面试过程中会被问到的面试问题，这些问题使用栅栏密码（rail fence cipher）进行编码。这种编码很容易被解密，因此在实际开始面试之前就能获得所有面试问题。如果你不同意条款，面试就不会开始，所以你可以随意反复访问该链接然后离开，直到你同意开始面试为止。HireVue...

CVE-2026-105876 WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11...

CVE-2026-105876

The WordPress Modula Image Gallery plugin (versions up to and including 3.0.11 ) contains a Missing Authorization vulnerability (CWE-862) within the modula-best-grid-gallery component. This flaw allows an attacker to Retrieve Embedded Sensitive Data from the plugin. No specific remediation steps ...

CVE-2026-105876 WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue affects Modula Image Gallery: from n/a through 3.0.11...

WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peter Tang in WordPress Plugin Modula Image Gallery versions = 3.0.11...

EUVD-2026-94213

A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An...

CVE-2025-14847

📝 MongoDB 扫描器 – 运行说明 脚本名称 mongoexposurescanner.py 1. 前提条件 Python 3.9+ 对目标主机的网络访问 已批准的扫描范围 验证 Python： python3 --version 2. 使用的文件 文件| 用途 ---|--- mongoscanner.py| 扫描器脚本 targets.txt| 目标主机和端口 mongoexposedtargets.txt| 扫描结果（自动创建） 3. 目标文件格式（targets.txt） 支持的格式： Host only default ports used 10.99.1.52...

Nuclei_Templates

🎯 Nuclei Templates A large personal collection of 50,000+...

CVE-2026-104849

A flaw was found in tinypool. When processing tasks with caller-supplied configuration options, the worker pool does not verify whether properties, such as the worker filename, belong directly to the provided object. An attacker who can manipulate shared JavaScript base objects prototype pollutio...

CVE-2025-12721

g-FFL Cockpit 'returntrue'，使其对任何未经身份验证的访问者完全可访问。 位于 class-sync-endpoint.php 中： 88: registerrestroute'fflcockpit/v1', '/serverstatus', 89: 'methods' = 'GET', 90: 'callback' = CLASS, 'handleserverstatus', 91: 'permissioncallback' = 'returntrue', // 公共端点 92: ; handleserverstatus 函数暴露： 服务器信息 ：PHP...

gitlab-component

gitlab-component 开始使用 为了让您轻松上手 GitLab，这里列出了一些推荐的后续步骤。 已经是专家了？只需编辑此 README.md 并使其成为您自己的。想更简单？使用底部的模板！ 添加您的文件 创建或上传文件 使用命令行添加文件或使用以下命令推送现有的 Git 仓库： cd existingrepo git remote add origin https://gitlab.com/guardia-ai/gitlab-component.git git branch -M main git push -uf origin main 与您的工具集成 设置项目集成...

CVE-2025-68664

CVE-2025-68664 这一切我想在圣诞节得到的就是你们的秘密：LangGrinch 袭击了 LangChain 核心 CVE-2025-68664 作者：亚尔登·波拉特 Cyata 研究：LangChain 中的 LangGrinch 漏洞 已发布：https://cyata.ai/blog/langgrinch-langchain-core-cve-2025-68664/ 昨天，LangChain 发布了一个关于我在 langchain-core 中发现的漏洞的关键警告：CVE-2025-68664 / GHSA-c67j-w6g6-q2cm。...

WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...

Intelbras WIN 300/WRN 342 - Credentials Disclosure

Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the defwirelesspassword line in the HTML source code. id: CVE-2021-3017 info: name: Intelbras WIN 300/WRN 342 - Credentials Disclosure author: pikpikcu severity: high description:...