Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 637

Export CSV
CVE-2026-9546

sending old referer

A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result, the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-8924

trailing dot domain super cookie

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Curl Curl
CVE-2026-6429

netrc credential leak with reused proxy connection

When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Curl Haxx
Products
Libcurl Curl
CVE-2026-11856

cross-origin Digest auth state leak

Successfully using libcurl to do a transfer to a specific HTTP origin (`hostA`) with **Digest** authentication and then changing the origin to a different one (`hostB`) for a second transfer, reusing the same handle, makes libcurl wrongly pass on the `Authorization:` header field meant for `hostA`, to `hostB`.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Curl Haxx Redhat
Products
Curl Curl Hummingbird
CVE-2026-89765

timers/itimer: Zero-init old itimerval before copy to userspace

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct __kernel_old_timeval contains a four-byte hole after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit. put_itimerval() fills only the named fields in a stack-allocated __kernel_old_itimerval and copies the entire object to userspace, so getitimer() can expose the two padding holes. Zero-initialize the aggregate before assigning the fields so implicit padding is deterministic before it crosses the user/kernel boundary.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-78303

Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potential email manipulation.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomshaper.com
Products
Sp Property Extension For Joomla
CVE-2026-78374

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled) and has no rate limiting. The attacker fully controls the recipient, subject and HTML body, and the mail is sent from the site's configured sender identity (mailfrom/fromname).

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Joomlart.com
Products
T4 Page Builder Extension For Joomla
CVE-2026-62088

WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
10up Wordpress
Products
Elasticpress Wordpress
CVE-2026-44487

Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was intended only for the outbound proxy. This vulnerability is fixed in 0.32.0 and 1.16.0.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Axios
Products
Axios
CVE-2026-44486

Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. This affects Node.js's use of Axios with automatic redirects enabled and an authenticated proxy configuration. Browser adapters are not affected. This vulnerability is fixed in 0.32.0 and 1.16.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Axios
Products
Axios
CVE-2026-81162

DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Drupal Dxpr Builder Project
Products
Dxpr Builder: The Best Editing (ai) Experience For Drupal Dxpr Builder
CVE-2026-65812

Microsoft Teams for Android Information Disclosure Vulnerability

Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Teams
CVE-2026-86497

Exfiltration of Mailbox Credentials by Project Administrator in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack
CVE-2026-85307

WordPress KP Agent Ready plugin < 1.2.08 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Kevin Pirnie Wordpress
Products
Kp Agent Ready Wordpress
CVE-2026-84127

Information disclosure in the WebExtensions component in Firefox for Android

Information disclosure in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 155.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Firefox Mobile
CVE-2026-79075

chromium-browser: chromium-browser: Information leak in Geolocation

Information leak in Geolocation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-55553

urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Node-modules
Products
Urllib
CVE-2026-75953

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_id_event) instead of the server-side offer/event record, so mail could be sent to an arbitrary address.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Cmsjunkie.com
Products
J-businessdirectory Extension For Joomla