Total
491 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-107268 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2. | |||||
| CVE-2026-45049 | 2026-10-30 | N/A | 8.3 HIGH | ||
| Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1. | |||||
| CVE-2026-119564 | 2026-10-30 | N/A | 5.3 MEDIUM | ||
| Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership. | |||||
| CVE-2026-116861 | 2026-10-30 | N/A | 7.5 HIGH | ||
| Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. | |||||
| CVE-2026-115947 | 2026-10-30 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. | |||||
| CVE-2026-118083 | 2026-10-30 | N/A | 7.5 HIGH | ||
| Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. | |||||
| CVE-2026-116689 | 2026-10-30 | N/A | 5.9 MEDIUM | ||
| follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2. | |||||
| CVE-2026-114485 | 2026-10-30 | N/A | 4.3 MEDIUM | ||
| Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response. | |||||
| CVE-2013-1840 | 2 Amazon, Openstack | 5 S3 Store, Essex, Folsom and 2 more | 2026-10-30 | 3.5 LOW | 6.5 MEDIUM |
| A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials. | |||||
| CVE-2026-105777 | 1 Gitlab | 1 Gitlab | 2026-10-30 | N/A | 4.3 MEDIUM |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers. | |||||
| CVE-2026-87863 | 2026-10-30 | N/A | 8.1 HIGH | ||
| An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss. | |||||
| CVE-2026-87862 | 2026-10-30 | N/A | 8.1 HIGH | ||
| Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS. | |||||
| CVE-2026-87861 | 2026-10-30 | N/A | 9.1 CRITICAL | ||
| When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused. | |||||
| CVE-2026-86415 | 2026-10-30 | N/A | 7.5 HIGH | ||
| libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this. | |||||
| CVE-2026-86414 | 2026-10-30 | N/A | 9.1 CRITICAL | ||
| An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`. | |||||
| CVE-2026-86413 | 2026-10-30 | N/A | 9.1 CRITICAL | ||
| When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there. | |||||
| CVE-2026-86409 | 2026-10-29 | N/A | 8.1 HIGH | ||
| Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information. | |||||
| CVE-2026-48200 | 2026-10-29 | N/A | 5.3 MEDIUM | ||
| Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0. | |||||
| CVE-2026-19603 | 1 Mattermost | 1 Mattermost Server | 2026-10-29 | N/A | 4.3 MEDIUM |
| Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints, without being a member of that channel. Mattermost Advisory ID: MMSA-2026-00765 | |||||
| CVE-2026-19601 | 1 Mattermost | 1 Mattermost Server | 2026-10-29 | N/A | 4.9 MEDIUM |
| Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature. Mattermost Advisory ID: MMSA-2026-00764 | |||||