12958 matches found
CVE-2026-64711
This CVE (CVE-2026-64711) relates to an entitlement-check issue where an app may leak sensitive user information. The connected details specify the vulnerable components as Apple operating systems and versions: iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 2...
CVE-2026-64553
The CVE-2026-64553 entry concerns the Linux kernel net/psample, specifically PSAMPLE_ATTR_DATA. The vulnerability was an information leak caused by open coding in nla_put() that failed to clear padding for netlink attributes, with data_len not necessarily multiple of 4B. The issue affects the psa...
EUVD-2026-49604
In the Linux kernel, the following vulnerability has been resolved: net: psample: fix info leak in PSAMPLEATTRDATA psample open codes nlaput presumably to avoid wiping the data with 0s just to override it with packet data. This open coding is missing clearing the pad, however, each netlink attr i...
libssh2: libssh2: Denial of service or information disclosure via malformed SSH publickey response
A flaw in libssh2 allows a malicious SSH server to send a malformed public key response, triggering an invalid memory cleanup. This can cause the connecting client application to crash or leak information...
User Profile Picture < 2.5.0 - Sensitive Information Disclosure
The REST API endpoint getusers in the User Profile Picture WordPress plugin before 2.5.0 returned more information than was required for its functionality to users with the uploadfiles capability. This included password hashes, hashed user activation keys, usernames, emails, and other less...
AntD Admin - Sensitive Information Disclosure
AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...
TrakSYS 11.x.x - Sensitive Data Exposure
A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export/pagedefinition. The manipulation of the argument ID leads to direct request. The attack may be initiated remotely. The exploit has been...
vLLM <= 0.23.0 - Anthropic Router Heap Address Information Leak
vLLM = 0.23.0 incompletely fixes CVE-2026-22778. The original fix added sanitizemessage to the OpenAI router but the Anthropic-compatible router /v1/messages echoes strexc directly. id: CVE-2026-54236 info: name: vLLM = 0.23.0 - Anthropic Router Heap Address Information Leak author: kenlacroix...
Dify User Enumeration via Observable Response Discrepancy
Dify is an open-source LLM app development platform. Prior to 1.9.0, responses from the Dify API to existing and non-existent accounts differ, allowing an attacker to enumerate email addresses registered with Dify. Version 1.9.0 fixes the issue. id: CVE-2026-28288 info: name: Dify User Enumeratio...
LearnPress < 4.2.6.8.1 - Information Disclosure
LearnPress – WordPress LMS Plugin contains a sensitive information exposure caused by incorrect implementation of getitemspermissionscheck function in all versions up to 4.2.6.8, letting unauthenticated attackers extract user emails and basic information. id: CVE-2024-5483 info: name: LearnPress...
Event Monster <= 1.4.3 - Information Exposure Via Visitors List Export
The Event Monster Event Management, Tickets Booking, Upcoming Event plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.4.3 via the Visitors List Export file. During the export, a CSV file is created in the wp-content folder with a hardcoded filename...
AVM FRITZ!Box 7530 AX - Unauthorized Access
An access control issue in the component /juisboxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information without authentication. id: CVE-2024-54767 info: name: AVM FRITZ!Box 7530 AX - Unauthorized Access author: DhiyaneshDK severity: high description: | An access...
EUVD-2026-48880
In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspanpda: fix information leak The write callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspanpda implementation will however...
CVE-2026-64336
CVE-2026-64336 affects the Linux kernel USB serial driver keyspan_pda. The information leak arose because the write() callback could report the number of characters submitted to the device when a write URB wasn’t in use, allowing data beyond the tty write buffer to be written. The root cause is t...
CVE-2026-64336 USB: serial: keyspan_pda: fix information leak
In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspanpda: fix information leak The write callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspanpda implementation will however...
CVE-2026-64336
In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspanpda: fix information leak The write callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspanpda implementation will however...
PT-2026-64557
In the Linux kernel, the following vulnerability has been resolved: USB: serial: keyspan pda: fix information leak The write callback is supposed to return the number of characters accepted or a negative errno. Since the addition of write fifo support the keyspan pda implementation will however...
kernel: vt: prevent kernel-infoleak in con_font_get()
In the Linux kernel, the following vulnerability has been resolved: vt: prevent kernel-infoleak in confontget font.data may not initialize all memory spaces depending on the implementation of vc-vcsw-confontget. This may cause info-leak, so to prevent this, it is safest to modify it to initialize...
CVE-2026-13066
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-sid...
