CWE-200

An issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction w

Jenkins 2.550 and earlier, LTS 2.541.1 and earlier accepts Run Parameter values that refer to builds the user submitting

In Splunk Enterprise versions below 10.0.2, 10.0.3, 9.4.8, and 9.3.9, a low-privileged user who does not hold the "admin

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, `skills.status` could disclose secrets to `operator.rea

A weakness has been identified in FastApiAdmin up to 2.2.0. Affected by this issue is the function download_controller o

Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's `AddonViewSet` (`weblate/api/views.py`

Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.6.0, the _redirect_to_target(

The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to,

The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of

Outline is a service that allows for collaborative documentation. Prior to 1.5.0, the events.list API endpoint, used for

Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, incre

The Download Manager plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, when a use

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the Compos

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-R

Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachmen

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to be

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to be

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to be

A vulnerability has been found in code-projects Movie Ticketing System 1.0. Impacted is an unknown function of the file

A weakness has been identified in code-projects Patient Record Management System 1.0. This affects an unknown part of th

A vulnerability was found in code-projects Online Library Management System 1.0. Affected is an unknown function of the

Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to p

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5,

StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 are susceptible to a Information Di

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions t

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Pr

The Table Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includ

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.17, a

Inappropriate implementation in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to obtain potential

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti

Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.5, when

A flaw has been found in Kilo-Org kilocode up to 7.0.47. This issue affects the function Load of the file packages/openc

The All in One SEO plugin for WordPress is vulnerable to Sensitive Information Exposure via 'internalOptions' localized

The Slider by Soliloquy – Responsive Image Slider for WordPress plugin for WordPress is vulnerable to Sensitive Informat

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to sanitize team memb

A weakness has been identified in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This imp

The PDF Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi

Inappropriate implementation in WebGL in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to l

Inappropriate implementation in iOS in Google Chrome on iOS prior to 148.0.7778.216 allowed a remote attacker to leak cr

The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Sensitive Information

Nextcloud is an open source content collaboration platform. From versions 5.5.13 to before 5.5.17, and 6.2.0 to before 6

eLabFTW is an open source electronic lab notebook. Prior to version 5.4.2, in certain cases, an authenticated user perfo

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP GetStatusInf

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 exposes an undocumented /agileconfigreset endpoint that returns

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 responds to version.bind CHAOS TXT queries, disclosing the DNS

A visibility control issue in the event template creation workflow allowed non-site-admin users to access private galaxi

A vulnerability in the MISP dashboard widgets allowed an authenticated user to manipulate the fields option and influenc