143218 matches found
PT-2026-63340
Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data...
PT-2026-63881
Name of the Vulnerable Software and Affected Versions Polylang versions prior to 3.8.6 Polylang Pro versions prior to 3.8.6 Description An issue allows the retrieval of embedded sensitive data, exposing system information to an unauthorized control sphere. Authenticated attackers with...
ROS-20260722-73-0007
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
CVE-2026-60371: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware component: Centralized Thirdparty Jars. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with access to the physical...
The vulnerability of the Microsoft SQL Server database management system, related to overflow in dynamic memory buffers, allows attackers to disclose sensitive information that is protected by this system’s security measures.
The vulnerability of the Microsoft SQL Server database management system is related to overflow in the buffer of dynamic memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by security measures...
The vulnerability of the components camel-netty-http and camel-undertow in the Apache Camel framework allows attackers to disclose protected information.
The vulnerability of the camel-netty-http and camel-undertow components of the Apache Camel framework is related to deficiencies in the error reporting mechanism. Exploiting this vulnerability can allow an attacker to disclose sensitive information that should be protected...
The vulnerability of the getParameter() function in the AbstractSalesforceProcessor class of the camel-salesforce component of the Apache Camel framework allows a attacker to disclose protected information.
The vulnerability of the getParameter function in the AbstractSalesforceProcessor class of the camel-salesforce component of the Apache Camel framework is related to vulnerabilities in the error reporting mechanism. Exploiting this vulnerability could allow an attacker to disclose sensitive...
CVE-2026-3482: Authorization Bypass Through User-Controlled Key
IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.52, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 could allow an unauthenticated user to read sensitive information by bypassing authentication through a specially crafted HTTP request...
CVE-2026-62456
Vulnerability in the Oracle HRMS UK product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle HRMS UK. While the...
CVE-2026-63143
Technical details (affected products, components, versions, exploitability) are not publicly available in the provided documents; monitor for updates.
CVE-2026-65318 Verba (goldenverba) Unauthenticated Server-Side Request Forgery via WebSocket Import Endpoint HTMLReader
Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...
CVE-2026-65318
Verba RAG application version 2.1.3 contains an unauthenticated server-side request forgery vulnerability that allows unauthenticated attackers to cause the backend to issue arbitrary HTTP GET requests by supplying attacker-controlled URLs through the WebSocket import endpoint. Attackers can...
EUVD-2026-46416
A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...
EUVD-2026-46358
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...
GHSA-5GGR-2F2H-JMVM Gitea: Local File Inclusion via file:// URI in Migration Restore
Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...
Gitea: Local File Inclusion via file:// URI in Migration Restore
Local File Inclusion via file:// URI in Migration Restore Target: go-gitea/gitea Component: services/migrations/giteauploader.go, modules/uri/uri.go Severity: High Affected Versions: = v1.22.x all releases, master as of latest commit Researchers: - Isa Can — Eresus Security...
CVE-2026-65056
CVE-2026-65056 describes a server-side request forgery in mcp-webresearch 0.1.7. The vulnerability arises because visit_page validates only URL protocol and does not filter private or reserved IP ranges, enabling an attacker to access internal network services by supplying loopback, link-local, o...
Insertion of Sensitive Information Into Sent Data
Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the GET /login/oauth/userinfo endpoint. An attacker can access identity claims such as email and groups by supplying a personal access token with insufficient scopes as a bearer...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the IntrospectOAuth process. An attacker can access sensitive metadata about tokens issued to other clients by submitting a valid token to the introspection endpoint using their own OAuth application's...