Information disclosure.

Mechanize sends credential headers to another origin after a meta refresh

• Information disclosure
• Hard-coded credentials

<2.14.1 · fixed in 2.14.1

Mechanize sends credential headers to another host after an HTTP redirect

• Information disclosure
• Hard-coded credentials

<2.14.1 · fixed in 2.14.1

PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure

• Information disclosure
• Broken access control

<1.7.3 · fixed in 1.7.3

PraisonAI: Jobs API is unauthenticated by default and allows attacker-controlled webhook SSRF

• Information disclosure
• Authentication bypass

<4.6.78 · fixed in 4.6.78

Mechanize sends credential headers to a different scheme or port after a redirect

• sparklemotion mechanize
• Information disclosure
• Weak cryptography or TLS

Security vulnerability affects the UNIX S-TAP component as part of IBM Guardium Data Protection

• IBM Guardium Data Protection
• Information disclosure

Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware

• TP-Link System Inc. Tapo S505 v1.6
• Information disclosure

MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters

• Information disclosure

<3.2.5 || >=3.3.0, <3.3.4 || >=3.4.0, <3.4.7 || >=3.5.0-rc.0, <3.5.4 · fixed in 3.2.5, 3.3.4, 3.4.7, 3.5.4

IBM Guardium Data Protection Information Disclosure

• IBM Guardium Data Protection
• Information disclosure

Docker Sandboxes egress proxy could forward unrecognized client credentials to managed hosts

• Docker Sandboxes
• Information disclosure

PraisonAI: ContextGatherer include resolution permits absolute and traversal reads outside the workspace

• Path traversal
• Information disclosure

<4.6.78 · fixed in 4.6.78

PraisonAI: Project custom command templates can read outside-workspace files into model prompts

• Path traversal
• Information disclosure

<4.6.78 · fixed in 4.6.78

Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`

• Information disclosure
• CWE-212

>=0.3.4, <1.107.4 || >=2.0.0b1, <2.27.1 · fixed in 1.107.4, 2.27.1

PraisonAI: FastContext path resolution permits absolute and traversal reads outside the workspace

• Path traversal
• Information disclosure

<1.6.78 · fixed in 1.6.78

Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`

• Information disclosure
• CWE-212

>=0.3.4, <1.107.6 || >=2.0.0b1, <2.44.0 · fixed in 1.107.6, 2.44.0

PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

• Code injection
• Information disclosure

<1.6.78 · fixed in 1.6.78

PraisonAI: DNS rebinding bypass in `web_crawl` SSRF protection allows internal response disclosure

• Information disclosure
• Race condition

<1.6.78 · fixed in 1.6.78

Keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints

• Red Hat Build of Keycloak
• Red Hat Single Sign-On 7
• Information disclosure

Parse Server 9.0.0 before 9.10.1-alpha.12 Class Name Disclosure via GraphQL Errors

• parse-community parse-server
• Information disclosure

Database Credentials Disclosure in AKIN Software's AKINSOFT WOLVOX Control Panel

• AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel
• Information disclosure

Information disclosure in Brocade Active Support Connectivity Gateway

• Brocade Active Support Connectivity Gateway
• Information disclosure

Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Parameter

• Track Orders for WooCommerce
• Information disclosure

SMS Alert 3.6.4 - 4.0.0 - Admin+ Network User Billing Phone Disclosure via Bulk User Actions

• SMS Alert
• Information disclosure

Wallet System for WooCommerce < 2.8.0 - Subscriber+ Store-Wide Wallet Transaction Disclosure via Export

• Wallet System for WooCommerce
• Information disclosure

BackWPup < 5.7.7 - Unauthenticated Sensitive Data Disclosure via Restore Working Directory on NGINX

• BackWPup
• Information disclosure

Booking Calendar 10.15 - 11.8.2 - Editor+ Arbitrary Option Disclosure

• Booking Calendar
• Information disclosure

Easy Digital Downloads < 3.7.1 - Subscriber+ Sensitive Information Disclosure via User Downloads Block

• Easy Digital Downloads
• Information disclosure

Insecure storage of sensitive information in Brocade SANnav

• Brocade SANnav
• Information disclosure

Sensitive information in log files in Brocade Fabric OS

• Brocade Fabric OS
• Information disclosure

pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros)

• pgjdbc
• Information disclosure
• CWE-226

Docling: Configured HTTP headers sent to every remote image host named by a document

• Information disclosure
• Hard-coded credentials

>=2.95.0, <2.132.0 · fixed in 2.132.0

Docling: Crafted DoclingDocument JSON embeds local image files into converted output

• Path traversal
• Information disclosure

>=2.16.0, <2.131.0 · fixed in 2.131.0

Payload external upload trust validation issue

• Information disclosure
• CWE-346

>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34

Ghost: Password Hash Ordering Disclosure in Ghost Admin API

• Information disclosure
• Other injection

>=0.7.2, <6.64.0 · fixed in 6.64.0

Ghost: Invite Token Disclosure in Ghost Admin API

• Information disclosure
• Other injection

>=4.39.0, <6.64.0 · fixed in 6.64.0

Backstage: Improper input validation in Sentry scaffolder actions

• Information disclosure
• Server-side request forgery (SSRF)

>=0.3.0, <0.3.8 · fixed in 0.3.8

PraisonAI: Crawl4AI/Chromium backend is also affected by the `web_crawl` SSRF validation bypass

• Information disclosure
• Race condition

<1.6.78 · fixed in 1.6.78

Apache Geode: Management REST API: Insertion of Sensitive Information into Log File

• Apache Software Foundation Apache Geode
• Information disclosure

pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections

• pgjdbc
• Information disclosure

Backstage has a sensitive information disclosure in Kubernetes resource queries

• Information disclosure
• Broken access control

<0.21.9 · fixed in 0.21.9

Backstage: Sensitive information exposure in Scaffolder

• Information disclosure

<3.3.1 || >=3.4.0, <3.4.1 || >=4.0.0, <4.0.3 || >=4.0.4, <4.1.0 · fixed in 3.3.1, 3.4.1, 4.0.3, 4.1.0

Backstage: Secret-derived values may be exposed in scaffolder task logs

• Information disclosure

<4.1.0 · fixed in 4.1.0

Backstage may expose sensitive information in Scaffolder task failure events

• Information disclosure

<4.1.0 · fixed in 4.1.0

Backstage has sensitive information exposure in scaffolder task logs

• Information disclosure

<4.1.0 · fixed in 4.1.0

Backstage has improper input validation in scaffolder task list ordering

• Information disclosure
• CWE-202

<4.1.0 · fixed in 4.1.0

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

• Information disclosure

<5.35.0 · fixed in 5.35.0

LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration

• Information disclosure

<10.27.2 · fixed in 10.27.2

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

• Cross-site scripting (XSS)
• Information disclosure

<3.3.0 · fixed in 3.3.0

Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token

• Information disclosure
• Broken access control

<26.7.0 · fixed in 26.7.0

User Private Files < 2.1.9 - Subscriber+ User Email Address Disclosure via dpk_upvf_rmv_access

• User Private Files
• Information disclosure

Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

• Optimole
• Information disclosure

WPCafe < 3.0.21 - Unauthenticated Product Data Disclosure via REST API

• WPCafe
• Information disclosure

Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File

• Geliver Akıllı Kargo Pazaryeri
• Information disclosure

Sensitive information in log files in ASUS Router

• ASUS Router
• Information disclosure

Langflow OSS is affected by multiple vulnerabilities

• IBM Langflow OSS
• Information disclosure

An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.

• Information disclosure

Gitea profile feed disclosure bypassing user visibility

• Gitea
• Information disclosure
• Broken access control

Gitea migration and pull mirror SSRF through multi-answer DNS

• Gitea
• Information disclosure
• Race condition

Local Disclosure of Sensitive Information in HPE Networking ClearPass Policy Manager Client Software

• Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)
• Information disclosure

Unauthenticated Sensitive Information Disclosure in AOS-S

• Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S)
• Information disclosure