tag
Information-Disclosure
Apache Polaris — Cross-Tenant Credential Vending Before Location Validation in Iceberg REST Register (CVE-2026-64640)
CVE-2026-64640 is a confused-deputy vulnerability in Apache Polaris: the Iceberg REST register endpoints mint cloud storage credentials for a caller-supplied path and read that path server-side before checking it against the catalog's allowedLocations. A…
Xiongmai XM530 IP Camera ONVIF Authentication Bypass (CVE-2025-65856)
CVE-2025-65856 is a critical authentication bypass in the ONVIF implementation shipped on Xiongmai XM530-based IP cameras. The device's deviceservice and mediaservice ONVIF SOAP endpoints accept and fully process requests such as GetDeviceInformation,…
Twonky Server 8.5.2 Unauthenticated `/nmc/rpc/` Auth Bypass & Admin Credential Log Leak (CVE-2025-13315)
CVE-2025-13315 is a critical access-control flaw in Twonky Server 8.5.2 discovered by Rapid7: an earlier fix restricted unauthenticated access to the /rpc/ endpoint prefix, but the equivalent /nmc/rpc/ routing path was left unprotected, so privileged RPC…
Squid Proxy Sensitive Header Leak via Error Page `mailto:` Diagnostic Block (CVE-2025-62168)
When Squid is configured with emailerrdata enabled (including in default configurations), it embeds diagnostic details about a failed request — including the original client's HTTP request headers — into the auto-generated error page it returns. Specifically,…
RustFS Hardcoded gRPC Authentication Token Leading to Full Node Compromise (CVE-2025-68926)
RustFS's internal cluster/node gRPC service (nodeservice.NodeService) authenticates peer-to-peer RPC calls using a fixed, hardcoded bearer token — the literal string "rustfs rpc" — which is compiled into every RustFS build and cannot be rotated or configured…
Pterodactyl Panel Unauthenticated Path Traversal via locale.json Leaking Database Credentials (CVE-2025-49132)
Pterodactyl Panel prior to version 1.11.11 exposes a /locales/locale.json endpoint that accepts attacker-controlled locale and namespace query parameters without a required integrity/hash check, allowing an unauthenticated attacker to traverse outside the…
AI Engine WordPress Plugin Unauthenticated MCP Token Disclosure to Admin Account Creation (CVE-2025-11749)
AI Engine's built-in Model Context Protocol (MCP) server, exposed via WordPress REST routes under /wp-json/mcp/v1/, discloses a per-site MCP access token directly in the unauthenticated route listing when the plugin's MCP feature (or a "No-Auth URL"-style…
ZTE ZXHN H298A / H108N Router Unauthenticated Credential Disclosure (CVE-2026-34474)
CVE-2026-34474 is an unauthenticated information disclosure in the web management interface of ZTE ZXHN H298A and H108N router firmware. A crafted GET request to getpage.lua?pid=1000ÐCheat=1 returns HTML containing the live administrator password, WLAN…
Xboard / V2Board — Magic Link Token Leak Unauth Account Takeover (CVE-2026-39912)
Both V2Board and its fork Xboard implement a "login with mail link" (magic link) feature. Their loginWithMailLink endpoint (AuthController.php in V2Board, MailLinkService.php in Xboard) generates the one-time login link and is supposed to only deliver it via…
WebKit WebGPU `importExternalTexture` Cross-Origin Video Frame Leak (CVE-2026-43700)
WebKit's GPUDevice.importExternalTexture({ source: HTMLVideoElement }) imports the current frame of a <video> element as a GPU-sampleable GPUExternalTexture. Prior to the fix, WebKit did not check the video element's taintsOrigin (cross-origin CORS-tainted)…
WebKit Navigation API `NavigateEvent.sourceElement` Cross-Origin DOM Leak (CVE-2026-43735)
CVE-2026-43735 is a WebKit Navigation API bug where, when a parent page uses a named <a target="iframeName"> link to trigger a fragment navigation inside a cross-origin <iframe>, the NavigateEvent.sourceElement delivered to the iframe's navigate event…
Veno File Manager Absolute Path Disclosure (CVE-2026-37069)
Absolute path disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to learn the system directory in which the application code is running by sending a GET…
phpSysInfo IP Allowlist Bypass via X-Forwarded-For Spoofing — CVE-2026-55584
phpSysInfo's PSIALLOWED IP allowlist feature determines the client IP by checking the attacker-controlled X-Forwarded-For header first, then Client-IP, and only falls back to the trustworthy REMOTEADDR socket address last. Because there is no concept of a…
Notepad++ nativeLang.xml Format String Crash / Info Disclosure — CVE-2026-3008
Notepad++'s Find Results panel initializer (sub1400916C0) retrieves the localized find-result-hits string from nativeLang.xml and passes it directly as the format string argument to wsprintfW, with no accompanying variadic data arguments and no validation of…
InvoicePlane Unauthenticated Path Traversal in Guest Controller (CVE-2026-23491)
InvoicePlane v1.6.3's Guest module exposes a getfile controller action that serves uploaded customer files. The action urldecode()s the requested filename and concatenates it directly onto a fixed base directory (uploads/customerfiles/) before passing the…
GitLab WebSocket GraphqlChannel Unauthorized Method Enumeration — CVE-2026-5173
CVE-2026-5173 allows a low-privileged authenticated GitLab user to invoke backend GraphQL methods over the /-/cable ActionCable WebSocket endpoint via the GraphqlChannel, methods that should otherwise be gated by normal GraphQL authorization checks. The PoC…
Gitea Container Registry Anonymous Auth Bypass (CVE-2026-27771)
Gitea's OCI Distribution Spec API (/v2/<name>/manifests/<ref>, /v2/<name>/blobs/<digest>) serves container image content to anonymous/ghost users without ever checking the package owner's configured visibility (private, limited, or public). The…
Apache HTTP Server mod_rewrite/mod_setenvif/mod_proxy_fcgi ap_expr Local File Read — CVE-2026-24072
Apache HTTP Server's apexpr expression evaluation engine exposes filesystem-introspection functions (file(), filesize(), and tests like -f, -d, -e, -s, -L, -h, -x) that are meant to be restricted when expressions are parsed from a .htaccess file rather than…
Android ActivityManagerService dumpBitmapsProto() Missing Permission Check (CVE-2026-0047)
ActivityManagerService.dumpBitmapsProto() is missing an enforceCallingOrSelfPermission(DUMP) check that should gate access to a system-wide UI bitmap dump used for debugging. Because the method body executes fully before any permission is verified, any…
Next.js unstable_cache Object-Argument Cache-Key Collision
Next.js's unstablecache() API derives its cache key by running JSON.stringify() over the arguments passed to the cached function. When a route handler passes a stock request-wrapper object — a Request, URLSearchParams, or FormData instance — directly into…
Firefox Smart Window Private URL Exfiltration
Firefox's Smart Window assistant exposes getopentabs and searchbrowsinghistory tools that return private tab/history URLs to the model and mark the conversation as containing privateData, but they never mark it as containing untrustedInput even though the…
Squidbleed — Squid Proxy FTP Gateway Out-of-Bounds Heap Read (CVE-2026-47729)
CVE-2026-47729, dubbed "Squidbleed," is an out-of-bounds heap read in Squid Proxy's FTP gateway and FTP directory-listing parser. The bug stems from legacy FTP parsing logic (originally written in 1997 for NetWare-style listings) in FtpGateway.cc, where…
Next.js i18n Middleware Bypass (CVE-2026-44573)
CVE-2026-44573 is an authorization bypass in Next.js Pages Router applications that use the i18n configuration. The middleware matcher regex's i18n branch does not correctly cover all locale-prefix permutations of next/data/<buildId>/<page>.json URLs. As a…