MinIO Cluster Deployment - Information Disclosure

MinIO is susceptible to information disclosure. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including MINIOSECRETKEY and MINIOROOTPASSWORD. An attacker can potentially obtain sensitive...

TerraMaster TOS < 4.2.30 Server Information Disclosure

TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure. id: CVE-2022-24990 info: name: TerraMaster TOS 4.2.30 Server Information Disclosure author: dwisiswant0 severity: high description: TerraMaster NAS devices running TOS prior to version 4.2.30 are...

Exploit for CVE-2026-107268

CVE-2026-107268: miniOrange 2FA for Drupal returns the site's...

CLEANSTART-2026-GO41173 Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly

Security vulnerability affects the apache-hive package. Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly...

cve-2020-10977-read-and-execute

CVE-2020-10977 чтение и выполнение О CVE-2020-10977 Отчет HackerOne: https://hackerone.com/reports/827052 Exploit-DB: https://www.exploit-db.com/exploits/48431 Как воспроизвести часть с выполнением вручную: От чтения к выполнению Об этом репозитории getsecret.py — основной скрипт. Он использует к...

CLEANSTART-2026-BT10409 undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe ...

CVE-2026-85008 affects multiple packages. undici's cache interceptor documents that only safe HTTP methods are cached, but its logic to skip caching is built by subtracting the configured methods from the set of safe methods, so an unsafe method such as POST, PUT, or DELETE is never placed in the...

CLEANSTART-2026-QE41365 undici's dump interceptor reads and discards a response body up to a configurable maximum size

CVE-2026-84947 affects multiple packages. undici's dump interceptor reads and discards a response body up to a configurable maximum size. See references for individual vulnerability details...

CLEANSTART-2026-KG46723 When returning errors, functions in the net/textproto package would include its input as part of the error

CVE-2026-42507 affects multiple packages. When returning errors, functions in the net/textproto package would include its input as part of the error. See references for individual vulnerability details...

CLEANSTART-2026-VG72480 ReverseProxy can forward queries containing parameters not visible to Rewrite functions

CVE-2026-39825 affects multiple packages. ReverseProxy can forward queries containing parameters not visible to Rewrite functions. See references for individual vulnerability details...

CLEANSTART-2026-AY49632 Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason

Security vulnerability affects the apache-nifi-registry package. A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason...

CLEANSTART-2026-YK34202 Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check

CVE-2026-59739 affects multiple packages. Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. See references for individual vulnerability details...

DEBIAN-CVE-2026-107315

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same...

CVE-2026-107315

pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same...

PT-2026-107850

The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's ema...

PT-2026-108139

Name of the Vulnerable Software and Affected Versions libmongocrypt affected versions not specified Description The explicit decryption component of MongoDB libmongocrypt may return an unrecognized encrypted payload without modification instead of triggering a decryption error. This allows an act...

PT-2026-108136

Name of the Vulnerable Software and Affected Versions MongoDB C++ Driver affected versions not specified Description The MongoDB C++ Driver discards content following an embedded NUL byte in specific field and collection names processed by the collection API. This behavior allows the driver and t...

PT-2026-107834

The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site...

PT-2026-108146

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.5 MariaDB Connector/Node.js versions prior to 3.3.4 MariaDB Connector/Node.js versions prior to 3.4.7 MariaDB Connector/Node.js versions prior to 3.5.4 Description When encoding GeoJSON Polygon a...

CVE-2026-67693

An issue in gnutls v.3.8.13 allows an attacker to obtain sensitive information via failing to reject end-entity X.509 certificates that contain a contradictory combination of Key Usage KU and Extended Key Usage EKU...

PT-2026-107784

An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink is configured to use an authenticated HTTP proxy, the system stores the full proxy URL. Anyone with access to the diagnostic support...