Total
491 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-42505 | 1 Golang | 1 Go | 2026-10-25 | N/A | 5.3 MEDIUM |
| Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. | |||||
| CVE-2026-56460 | 1 Hcltechsw | 2 Hcl Devops Deploy, Hcl Launch | 2026-10-25 | N/A | 6.5 MEDIUM |
| HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system. | |||||
| CVE-2026-59519 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| Insertion of Sensitive Information Into Sent Data vulnerability in Softaculous FormLayer allows Retrieve Embedded Sensitive Data. This issue affects FormLayer: from n/a through 1.0.6. | |||||
| CVE-2026-59511 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| Insertion of Sensitive Information Into Sent Data vulnerability in Tim Strifler Exclusive Addons Elementor allows Retrieve Embedded Sensitive Data. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.9. | |||||
| CVE-2026-44970 | 1 Getdbt | 1 Dbt Mcp Server | 2026-10-24 | N/A | 3.1 LOW |
| dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabs_vortex.producer.log_proto without redaction, including sql_query from show, vars from run, build, and test, and node_selection from compile, while usage_tracking_enabled in settings.py enabled telemetry by default unless DBT_SEND_ANONYMOUS_USAGE_STATS=false or DO_NOT_TRACK=1 was set. This issue is fixed in version 1.17.1. | |||||
| CVE-2026-7488 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data. This issue affects E-Commerce: through 03062026. | |||||
| CVE-2026-7189 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Proliz's OBS: before v3.6.0. | |||||
| CVE-2026-13380 | 1 Vsee | 2 Clinic, Clinic Api | 2026-10-24 | N/A | 7.5 HIGH |
| VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server. | |||||
| CVE-2026-12547 | 2026-10-24 | N/A | 3.4 LOW | ||
| SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials. | |||||
| CVE-2026-66696 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions. | |||||
| CVE-2026-66683 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions. | |||||
| CVE-2026-66684 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions. | |||||
| CVE-2026-65543 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. | |||||
| CVE-2026-66463 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions. | |||||
| CVE-2026-66901 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the request. For an external_account configuration, retrieve_subject_token fetched credential_source.url with headers from the same JSON, and fetch_access_token posted the subject token to token_url, then sent the STS access token it received to service_account_impersonation_url in an Authorization: Bearer header. The authorized_user, impersonated_service_account and service_account configurations posted the client secret and refresh token, the source access token, and a signed JWT assertion to their own JSON-supplied token_uri or impersonation URL. Any caller that builds credentials from a configuration it does not fully control issues those requests from the application's network position, reaching hosts the configuration names, including internal services and link-local metadata endpoints, and hands them the credentials each request carries. The service_account assertion is bound to aud, so it is not replayable against Google. Version 0.06 added a _validate_url host check to the external_account class, keyed on a universe_domain read from the same credentials JSON. Version 0.07 gated a JSON-supplied universe domain behind GOOGLE_EXTERNAL_ACCOUNT_ALLOW_CUSTOM_UNIVERSES=1, deriving the pin flag from arguments that an earlier BUILDARGS pass had already merged on the make_creds path. Version 0.08 passed the pin decision through as an explicit constructor argument and moved _validate_url to Google::Auth::Credentials, adding the call to UserRefreshCredentials and ImpersonatedServiceAccountCredentials, and 0.09 added it to ServiceAccountCredentials. | |||||
| CVE-2026-66685 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions. | |||||
| CVE-2026-16798 | 1 Devolutions | 1 Powershell Universal | 2026-10-24 | N/A | 6.5 MEDIUM |
| Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token. | |||||
| CVE-2026-65434 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions. | |||||
| CVE-2026-67425 | 2026-10-24 | N/A | 8.6 HIGH | ||
| Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from the environment and sends them in the Authorization: Bearer header to caller-controlled base_url, allowing an attacker to receive the operator's key on a public host that passes the SSRF guard. This issue is fixed in version 2.26.6. | |||||
| CVE-2026-64643 | 1 Vercel | 1 Next.js | 2026-10-24 | N/A | 5.3 MEDIUM |
| Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11. | |||||