CWE-200

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported ve

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GET /api/v1

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket. This issue affects Apache Wi

Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. A crafted request to

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue a

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulne

This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18

An information leakage was addressed with additional validation. This issue is fixed in macOS Tahoe 26.5. An app may be

Strapi is an open source headless content management system. Strapi versions starting in 4.0.0 and prior to 5.37.0 did n

An issue in prestashop upsshipping all versions through at least 2.4.0 allows a remote attacker to obtain sensitive info

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFB

Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 151 and Thunderbird 15

Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Acce

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, ui.restructured_text() renders reStructuredText server-

It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some

The hard-coded APK resource files never expire, and the shared scepter leads to information leaks and potential misuse.

Overly permissive configuration settings on cloud storage containers expose active telemetry information publicly to the

The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to re

An information disclosure vulnerability in the /api/v1/user/info endpoint of AgentChat v2.3.0 allows unauthenticated att

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapte

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to be

An issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitive information via th

An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1.2.3 allows attacker

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthor

Capgo before 12.128.2 contains an information disclosure vulnerability in Supabase PostgREST RPC endpoints is_trial_org

Capgo before 12.128.2 contains an unauthenticated security definer RPC function get_identity_apikey_only that returns th

Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are s

Capgo before 12.128.2 contains an information disclosure vulnerability in the /functions/v1/channel_self endpoint that a

vLLM is an inference and serving engine for large language models (LLMs). From 0.5.5 until 0.23.1rc0, integer truncation

Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /updates endpoint that res

Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensit

Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensit

Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensit

Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environ

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint

Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated

Capgo before 12.128.2 contains unauthenticated security definer RPC functions get_user_id and get_org_perm_for_apikey th

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulne

Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, exposing

Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

Notification API leaks private issue metadata after access revocation