1398 matches found
EUVD-2026-103320
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to verify whether an attachment's parent FAQ is published or visible to the requester. Authenticated users with the dlattachment permission can request...
intra-handshake-fail
Intra-handshake fail This is the working area for the individual Internet-Draft, "Intra-handshake fail". Editor's Copy Datatracker Page Individual Draft Compare Editor's Copy to Individual Draft Contributing See the guidelines for contributions. The contributing file also has tips on how to make...
RAGE
RAGE - Relational Attack Graph Exchange An attack graph you can actually hand to someone else. Every graph-based security product keeps your attack graph locked inside a proprietary store. You cannot export it, diff two scans, put it in version control, or query it with anything but the vendor's...
CVE-2026-110218
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish...
EUVD-2026-98895
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...
CVE-2026-110218: Missing Authorization
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish...
CVE-2026-110131: Missing Authorization
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...
PT-2026-111722
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/id endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can request sequential article ids or supply isDraft=true or...
Use of Cache Containing Sensitive Information
Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via cross-request deduplication in the 'use cache' mechanism, where draft mode state is not accounted for when sharing cached fills between concurrent requests. A...
EUVD-2026-91668
Next.js: Pending use cache fill can leak Draft Mode content into regular responses and persisted pages...
GHSA-3W37-WQ28-93X7 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill: - A regular request that overlaps an editor's Draft Mode request receives...
NPM: Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
NPM: Next.js: Pending use cache fill can leak Draft Mode content into regular responses and persisted pages vulnerability discovered by ? in WordPress Npm next versions = 16.3.0, 16.3.8...
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill: - A regular request that overlaps an editor's Draft Mode request receives...
CVE-2026-95153
An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...
PT-2026-106804
An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...
CVE-2026-95153: Exposure of Sensitive Information to an Unauthorized Actor
An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...
CVE-2026-95153
An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...
EUVD-2026-93552
An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints...
CVE-2026-95153
A vulnerability exists in Bludit CMS 3.22.0 that allows a remote attacker to obtain sensitive information . The issue is accessible via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints. No specific root cause, exploit details, or remediation steps are provided in the available docum...
CVE-2026-94544
A flaw was found in Next.js. Pending cache operations do not properly separate Draft Mode requests from standard requests when fulfilling matching cache keys. Under concurrent request conditions, an unauthenticated user can receive unpublished draft content generated during an editor's session. I...