EUVD-2025-199761

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user with access to certain logs to obtain sensitive tokens under specific conditions...

CVE-2025-13611

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 that could have allowed an authenticated user with access to certain logs to obtain sensitive tokens under specific conditions...

CVE-2025-13611

GitLab CVE-2025-13611 affects GitLab CE/EE versions 13.2 to 18.4.5, 18.5 to 18.5.3, and 18.6 to 18.6.1. An authenticated user with access to certain logs could obtain sensitive tokens under specific conditions. The issue has been remediated by patches in GitLab, with fixed releases noted as 18.6....

CVE-2025-65957

Core Bot (open-source Discord bot for maple hospital servers) contained an information-disclosure vulnerability prior to commit dffe050, where API keys (SUPABASE_API_KEY, TOKEN) loaded from environment variables could be exposed in configuration summaries, logs, or embeds due to incomplete redact...

MAL-2025-191139 Malicious code in pergeltest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30c58cbe926b3e974924e37d17a2a498b8c47ee601e0bdf781d3bd385d27779b The package pergeltest was found to contain malicious code. Source: ghsa-malware 5ffcb1d48425e2a6a81862b0d4f1bd3eaddef69103c0d9949ddbf2d359d2d1f1 Any...

BIT-GITLAB-2025-11990 Improper Handling of URL Encoding (Hex Encoding) in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses...

JetBrains YouTrack < 2025.3.104432 Multiple Vulnerabilities

The version of JetBrains YouTrack installed on the remote host is prior to 2025.2.92387. It is, therefore, affected by multiple vulnerabilities as referenced in the advisory. - In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure. CVE-2025-64685 - ...

CVE-2025-64706 Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure

Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference IDOR vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by simply knowing th...

CVE-2025-64706 Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure

Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference IDOR vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by simply knowing th...

CVE-2025-64706

Typebot (open-source chatbot builder) contains an IDOR vulnerability in the API token management endpoint affecting versions 3.9.0 through 3.12.9 (up to but excluding 3.13.0). An authenticated attacker can delete any user’s API token and retrieve its value by knowing the target user ID and token ...

CVE-2025-64706 Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure

Typebot is an open-source chatbot builder. In version 3.9.0 up to but excluding version 3.13.0, an Insecure Direct Object Reference IDOR vulnerability exists in the API token management endpoint. An authenticated attacker can delete any user's API token and retrieve its value by simply knowing th...

CVE-2025-64689

In JetBrains YouTrack before 2025.3.104432 misconfiguration in the Junie could lead to exposure of the global Junie token...

PT-2025-46158

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2025.3.104432 Description A misconfiguration within the internal component called Junie in JetBrains YouTrack can result in the exposure of the global Junie token. This token is used for internal...

CVE-2025-52662

Nuxt DevTools contains an XSS vulnerability that could allow extraction of authentication tokens under certain configurations. The issue has been fixed in version 2.6.4, and users are advised to upgrade to mitigate the risk. Affected component: Nuxt DevTools; nature: cross-site scripting on the a...

CVE-2025-63691

In pig-mesh Pig 3.8.2 and earlier, the /api/admin/sys-token/page token query endpoint in the Token Management function (System Management) has improper permission checks, enabling information leakage. Any authenticated user can call this endpoint and retrieve plaintext authentication Tokens for a...

CVE-2025-11749

The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract th...

EUVD-2025-37961

Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authentication token for DCV-based WorkSpaces to other local users on the same client machine. Under certain circumstances, a local user may be able to extract...

CVE-2025-12779

Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authentication token for DCV-based WorkSpaces to other local users on the same client machine. Under certain circumstances, a local user may be able to extract...

CVE-2025-12779

Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authentication token for DCV-based WorkSpaces to other local users on the same client machine. Under certain circumstances, a local user may be able to extract...

CVE-2025-11749

The WordPress AI Engine plugin (≤ 3.1.3) is vulnerable to unauthenticated sensitive information exposure via the REST API endpoints under /mcp/v1/ when No-Auth URL is enabled. This allows attackers to retrieve the Bearer Token, enabling session hijacking and actions such as creating an administra...