Sensitive Information Disclosure

cyberdrop-dl-patched is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper host validation that matches supported domains using substring checks, which allows an attacker to use a malicious lookalike domain and capture the user's API key through the Authorization...

Sensitive Information Disclosure

routesrv is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the lack of authentication on HTTP endpoints exposing routing and cache topology data, which allows an attacker with network access to retrieve sensitive cluster-wide configuration and infrastructure informati...

Path Traversal

mcp-memory-keeper is vulnerable to Path Traversal. The vulnerability is due to the contextimport function reading user-supplied file paths without path validation or confinement, which allows an attacker to access arbitrary readable files and disclose sensitive information through imported conten...

MGASA-2026-0257 Updated nodejs packages fix security vulnerabilities

lib,test: redact proxy credentials in tunnel errors. CVE-2026-48615 permission: handle process.chdir on writereport. CVE-2026-48617 tls: normalize hostname for server identity checks. CVE-2026-48618 http2: cap originSet size to prevent unbounded memory growth. CVE-2026-48619 tls: fix case-sensiti...

PT-2026-60951

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.2.6 SurrealDB versions prior to 2.3.6 SurrealDB versions prior to 2.1.8 SurrealDB versions prior to 3.0.0-alpha.8 Description An authenticated user can bypass network access restrictions in http:: functions. The...

Linux Distros Unpatched Vulnerability : CVE-2026-50163

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the...

CVE-2026-52584

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function...

CVE-2026-8861

IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2026-54171

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial...

AZL-92460 CVE-2026-54171 affecting package rubygem-excon for versions less than 0.102.0-2

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial...

CVE-2026-50163

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...

CVE-2026-54171

Excon CVE-2026-54171 concerns the RedirectFollower middleware in Ruby’s Excon prior to v1.5.0, which failed to redact additional sensitive headers when following redirects. The issue could allow leakage of header data from the initial request to the redirected target. A fix is available in v1.5.0...

CVE-2026-54171

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial...

CVE-2026-54171 Excon: redact additional sensitive/risky headers when following redirects

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial...

CVE-2026-54171

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial...

CVE-2026-54171

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial...

CVE-2026-54171 Excon: redact additional sensitive/risky headers when following redirects

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial...

EUVD-2026-45312

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial...

CVE-2026-54171 Excon: redact additional sensitive/risky headers when following redirects

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial...

CVE-2026-50163

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...