VulnCheck KEV: CVE-2026-55450

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the REST API error handler returning unsanitized PHP error messages that include the full filesystem path. An attacker can obtain sensitive system path...

Information Exposure

Overview org.webjars.npm:nuxt is a Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettings is enabled. An attacker can...

Information Exposure

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettin...

WordPress CMB2 - Full Path Disclosure Detection

WordPress CMB2 plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress CMB2 plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from lib.protocols.http.httpclient...

WordPress Plugin Google Tag Manager - Full Path Disclosure Detection

WordPress Plugin Google Tag Manager files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Google Tag Manager files are publicly accessibl...

WordPress Plugin GDPR Cookie Consent - Full Path Disclosure Detection

WordPress GDPR Cookie Consent cookie-law-info plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress GDPR Cookie Consent cookie-law-info plugin is vulnerable to full path disclosure via direct access.""" from...

MyBB - Full Path Disclosure Detection

Detected MyBB forum software exposed the server's full filesystem path through PHP fatal errors when files that implemented interfaces were accessed without dependencies. !/usr/bin/env python3 -- coding: utf-8 -- """Detected MyBB forum software exposed the server's full filesystem path through PH...

WordPress OceanWP - Full Path Disclosure Detection

WordPress OceanWP theme is vulnerable to full path disclosure via direct access to theme files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress OceanWP theme is vulnerable to full path disclosure via direct access to theme files.""" from kittysploit import from lib.protocols.http.httpclien...

WordPress AMP - Full Path Disclosure Detection

The WordPress AMP - Accelerated Mobile Pages plugin was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated access to the full application path. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress AMP - Accelerated Mobile Pages plugin was detected to be vulnerable t...

Discuz! X2.5 - Path Disclosure Detection

Discuz! X2.5 api.php path disclosure vulnerability !/usr/bin/env python3 -- coding: utf-8 -- """Discuz! X2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Discuz! X2.5 - Path Disclosure Detection', 'description':...

Beaver Builder Page Builder - Full Path Disclosure Detection

Beaver Builder Page Builder WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Beaver Builder...

vBulletin - Full Path Disclosure Detection

Detects vBulletin - Full Path Disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects vBulletin - Full Path Disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'vBulletin - Full Path Disclosure...

WordPress Plugin reCaptcha by BestWebSoft (google-captcha) - Full Path Disclosure Detection

WordPress ManageWP Worker plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress ManageWP Worker plugin files are publicly accessible...

DedeCMS 5.7 - Path Disclosure Detection

DedeCMS 5.7 allows remote attackers to discover the full path via a direct request for include/downmix.inc.php or inc/incarchivesfunctions.php !/usr/bin/env python3 -- coding: utf-8 -- """DedeCMS 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

emlog 5.3.1 Path Disclosure Detection

emlog v5.3.1 is susceptible to full path disclosure via t/index.php, which allows an attacker to see the path to the webroot/file. !/usr/bin/env python3 -- coding: utf-8 -- """emlog v5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

CouchCMS <= 2.0 - Path Disclosure Detection

CouchCMS = 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php. !/usr/bin/env python3 -- coding: utf-8 -- """CouchCMS = 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Drupal 11.x-dev - Full Path Disclosure Detection

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. !/usr/bin/env python3 -- coding: utf-8 -- """core/authorize.""" from kittysploit import from lib.protocols.http.httpclient...

Campaign Monitor for WordPress - Information Disclosure Detection

Campaign Monitor for WordPress plugin for WordPress versions up to 2.8.15 contains a full path disclosure caused by improper access restriction and enabled displayerrors in /forms/views/admin/create.php, letting unauthenticated attackers retrieve server paths, exploit requires displayerrors to be...

WP Popups - Information Disclosure Detection

WP Popups - WordPress Popup builder plugin for WordPress contains a full path disclosure caused by using mobiledetect without access restrictions, letting unauthenticated attackers retrieve server paths, exploit requires no specific conditions. !/usr/bin/env python3 -- coding: utf-8 -- """WP Popu...