1456 matches found
CVE-2025-70841
Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct request to /script/.env file. The exposed file contains Laravel application encryption key APPKEY, database credentials, SMTP/SendGrid API...
Insertion of Sensitive Information into Log File
Overview omni-cortex is a Give Claude Code a perfect memory - auto-logs everything, searches smartly, and gets smarter over time Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File. Activity logging fails to redact sensitive fields before writing t...
PT-2026-5393
Name of the Vulnerable Software and Affected Versions HIKSEMI NAS products affected versions not specified Description A flaw exists in certain HIKSEMI NAS products due to improper handling of filenames. This can result in the disclosure of sensitive system files. Recommendations At the moment,...
CVE-2026-22625: Improper Limitation of a Pathname to a Restricted Directory
Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of sensitive system files...
CVE-2026-0936 Insertion of Sensitive Information into Logfile
An Insertion of Sensitive Information into Log File vulnerability in B&R PVI client versions prior to 6.5 may be abused by an authenticated local attacker to gather credential information which is processed by the PVI client application. The logging function of the PVI client application is...
CVE-2020-36939 Cassandra Web 0.5.0 - Remote File Read
Cassandra Web 0.5.0 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating path traversal parameters. Attackers can exploit the disabled Rack::Protection module to read sensitive system files like /etc/passwd and retrieve Apache...
Exploit for Path Traversal in Aiohttp
CVE‑2024‑23334 Path Traversal - PoC I created this script t...
EUVD-2025-206374
With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as "/etc/passwd", as well as stored certificates, cryptographic keys, stored PINs and so on can be modified and...
CVE-2025-67652 AutomationDirect CLICK Programmable Logic Controller Weak Encoding for Password
An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services. The absence of robust encryption or secure handling mechanisms increases the likelihood of this type of exploitation, leavi...
Security Bulletin: Multiple Vulnerabilities in IBM Engineering AI hub.
Summary Multiple vulnerabilities were addressed in IBM Engineering AI Hub version 1.1.0. Vulnerability Details CVEID:CVE-2025-58751 DESCRIPTION: Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the publi...
CVE-2026-0905
Google Chrome versions prior to 144.0.7559.59 are affected by a security bypass vulnerability due to insufficient policy enforcement within the Network component. An attacker who successfully obtains a network log file can exploit this weakness to potentially access sensitive information . This v...
MiracleLinux 9 : skopeo-1.16.1-1.el9 (AXSA:2024-9102:06)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9102:06 advisory. containers/image: digest type does not guarantee valid type CVE-2024-3727 golang: net: malformed DNS message can cause infinite loop CVE-2024-24788...
Insertion of Sensitive Information into Log File
Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the checkJdbcConnParams and decode functions. An attacker can access sensitive information, such as plaintext passwords, by causing a Base64 decoding failure, which results in the...
Directory Traversal
Overview Crawl4AI is a 🚀🤖 Crawl4AI: Open-source LLM Friendly Web Crawler & scraper Affected versions of this package are vulnerable to Directory Traversal via the Docker API endpoints that accept file:// URLs. An attacker can access sensitive files on the server filesystem by submitting crafted...
CVE-2026-22798 hermes's raw options logging may disclose secrets passed in via subcommand options argument
hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens e.g., via...
CVE-2026-22798 hermes's raw options logging may disclose secrets passed in via subcommand options argument
hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens e.g., via...
CVE-2023-4335
Broadcom RAID Controller Web server nginx is serving private server-side files without any authentication on Linux...
CVE-2021-0337
In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-...