VulnCheck KEV: CVE-2026-55450

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, unauthenticated users can upload any amount of data to the server without any limitations. No need for any prior knowledge, only network access to Langflow. This can lead to space exhaustion on the...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the REST API error handler returning unsanitized PHP error messages that include the full filesystem path. An attacker can obtain sensitive system path...

Information Exposure

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettin...

Information Exposure

Overview org.webjars.npm:nuxt is a Affected versions of this package are vulnerable to Information Exposure via the Chrome DevTools workspace endpoint when the development server is bound to a network-reachable interface and experimental.chromeDevtoolsProjectSettings is enabled. An attacker can...

emlog 5.3.1 Path Disclosure Detection

emlog v5.3.1 is susceptible to full path disclosure via t/index.php, which allows an attacker to see the path to the webroot/file. !/usr/bin/env python3 -- coding: utf-8 -- """emlog v5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

WordPress WPForms - Full Path Disclosure Detection

WordPress Plugin WPForms files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin WPForms files are publicly accessible without ABSPATH...

User Role Editor - Full Path Disclosure Detection

User Role Editor WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """User Role Editor WordPres...

WordPress WPFront Scroll Top - Full Path Disclosure Detection

WordPress Plugin WPFront Scroll Top plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin WPFront Scroll Top plugin files are...

WordPress Yoast SEO - Full Path Disclosure Detection

WordPress Yoast SEO plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Yoast SEO plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

WP Popups - Information Disclosure Detection

WP Popups - WordPress Popup builder plugin for WordPress contains a full path disclosure caused by using mobiledetect without access restrictions, letting unauthenticated attackers retrieve server paths, exploit requires no specific conditions. !/usr/bin/env python3 -- coding: utf-8 -- """WP Popu...

WordPress Plugin Intuitive Custom Post Order - Full Path Disclosure Detection

WordPress Widget Logic plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Widget Logic plugin files are publicly accessible without...

WordPress Elementor Page Builder - Full Path Disclosure Detection

WordPress Plugin Elementor Page Builder plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Elementor Page Builder plugin files...

WordPress Storefront Theme - Full Path Disclosure Detection

The Storefront theme for WordPress was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated attackers to obtain the full application path that could aid other attacks when combined with another vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The Storefront theme...

WordPress Menu Image - Full Path Disclosure Detection

WordPress Plugin Menu Image plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Menu Image plugin files are publicly accessible...

WordPress LazyLoad Plugin - Full Path Disclosure Detection

WordPress Plugin LazyLoad files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin LazyLoad files are publicly accessible without ABSPATH...

WordPress Ivory Search - Full Path Disclosure Detection

WordPress Plugin Ivory Search plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Ivory Search plugin files are publicly...

Admin Menu Editor - Full Path Disclosure Detection

Admin Menu Editor WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Admin Menu Editor...

WordPress Advanced iFrame - Full Path Disclosure Detection

WordPress Advanced iFrame plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Advanced iFrame plugin files are publicly accessible...

WordPress Data Source for Contact Form 7 - Full Path Disclosure Detection

WordPress Plugin CData Source for Contact Form 7 files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin CData Source for Contact Form 7...

WordPress Elementor Pro - Full Path Disclosure Detection

WordPress Plugin Elementor Pro plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Elementor Pro plugin files are publicly...