PT-2026-62039

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database. SQL injecti...

ROS-20260721-73-0041

The vulnerability of the Autofill function in Google Chrome and Microsoft Edge browsers is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow attackers to disclose sensitive information remotely...

PT-2026-62961

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise FIN Common Objects Brazil version 9.1 Description A flaw in the Purchasing component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can...

CVE-2026-50756

An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component...

PT-2026-62081

Name of the Vulnerable Software and Affected Versions DayuanJiang next-ai-draw-io version 0.4.13 Description A remote attacker can obtain sensitive information by manipulating the X-Forwarded-For header value. Recommendations At the moment, there is no information about a newer version that...

PT-2026-63313

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The ToHook function in services/webhook/general.go decrypts the HeaderAuthorizationEncrypted field and returns the plaintext authorization header in the API response. This allows repository...

PT-2026-63261

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Missing authorization allows a user with limited feature privileges to access workflow execution outputs within their Kibana space. This occurs because the documented API does not properly...

CVE-2026-52475

Cross Site Scripting vulnerability in aiflowy = 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the RedirectMiddleware process. An attacker can access sensitive information included in URI fragments by controlling the redirect destination and inspecting the...

CVE-2026-51031

FlareSolverr before version 3.4.7 contains a server-side request forgery SSRF vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information...

webkitgtk: webkitgtk: Visiting a website may leak sensitive data

A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...

webkitgtk: webkitgtk: Visiting a website may leak sensitive data

A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...

CVE-2026-51026

Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request...

axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...

CVE-2026-64622 Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

CVE-2026-63735

SurrealDB is affected: versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing an authenticated user to invoke endpoints in other namespaces/databases by specifying the target scope in the URL path. This could let attackers read sensitive data or trigger...

CVE-2026-63735 SurrealDB before 3.2.0 Authentication Bypass via Custom API

SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by...

CVE-2026-2445 Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

CVE-2026-2445

CVE-2026-2445 involves a reflected cross-site scripting (XSS) flaw in multiple WSO2 products where user-supplied input in a URL parameter is rendered without proper sanitization/encoding. The underlying issue is unsafe handling of URL parameters that can inject malicious JavaScript, enabling brow...

CVE-2026-51026

Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request...