Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 636

Export CSV
CVE-2026-126133

Calendar server credentials could be sent to an HTTP proxy

When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent without any user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even for calendars served over HTTPS. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-71863

SecureDrop: Onion Service client auth credentials copied to Monitor Server

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the journalist alert key filename empty, causing the copy task to transfer every file in ~/.config/securedrop-admin/, including Onion Service client authentication credentials, to the Monitor Server. An attacker must first compromise the privileged Monitor Server to obtain the credentials, and the credentials remain an additional protection layer rather than sufficient access by themselves because the Journalist Interface still requires a username, passphrase, and MFA, while SSH access still requires SSH keys. This issue is fixed in version 2.16.1.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed
Vendors
Freedomofpress
Products
Securedrop
CVE-2026-124944

Information disclosure in the Marionette component

Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-124925

Information disclosure in the Layout component

Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-123513

Vikunja before 2.7.1 Auth Token Leak via API URL Change

Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-120716

Sensitive MFA Secret Leakage via Identity Provider Synchronization API

Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Devolutions
Products
Devolutions Server Server
CVE-2026-114366

Information disclosure vulnerability in authentication handling of QWebSocket impacts Qt Framework

An information disclosure vulnerability in the Qt Framework QWebSocket authentication handling of the Qt WebSockets module.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Qt
Products
Qt Qt Framework Qtwebsockets
CVE-2026-111753

Angular: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Angular
Products
Angular
CVE-2026-113372

Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key

Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository. A party that holds the key can sign repository metadata as that repository.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sonatype
Products
Nexus Repository Manager
CVE-2026-113371

Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase

Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the repository.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sonatype
Products
Nexus Repository Manager
CVE-2026-121554

cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects

cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, native iOS and Android stacks forward the Cookie header, letting attackers hijack user sessions.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Silkimen
Products
Cordova-plugin-advanced-http
CVE-2025-68040

WordPress WP Project Manager plugin <= 3.0.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through 3.0.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress
Products
Wp Project Manager Wordpress
CVE-2026-123551

OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Openidentityplatform
Products
Openam
CVE-2023-34968

Samba: spotlight server-side share path disclosure

A path disclosure vulnerability was found in Samba. As part of the Spotlight protocol, Samba discloses the server-side absolute path of shares, files, and directories in the results for search queries. This flaw allows a malicious client or an attacker with a targeted RPC request to view the information that is part of the disclosed path.

CVSS 3.1 · 5.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 1 more
Products
Debian Linux Fedora Enterprise Linux and 5 more
CVE-2026-117649

Gitea private issue disclosure through issue dependency timeline events

The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access, but not "dependency added" and "dependency removed" events. When a readable issue had been linked as a dependency to an issue in a repository the reader cannot access, for example a private repository, any reader of the first issue, including anonymous users of a public repository, received the linked issue's current title, body, state, labels, poster and attachment names through the API, and its repository, number and title on the web page. Creating the link requires access to both issues; comments and attachment downloads of the linked issue stayed protected. Dependency events are now filtered with the same read permission check; a related exposure of unlinked attachment metadata through hidden dependency placeholders was already fixed in 28.2.0.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-119533

Gitea private pull request disclosure on project boards

Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the private repository's path and the pull request's number, title and state, to anonymous visitors in the case of a public board. The pull request body, diff and files were not exposed. Boards now skip linked pull requests in repositories where the viewer cannot read pull requests.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-12547

Libsoup: information disclosure in libsoup via soupauthmanager proxy credential leak on proxy switch

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Libsoup Redhat
Products
Libsoup Enterprise Linux
CVE-2026-74673

Input: evdev - fix information leak in evdev_pass_values()

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - fix information leak in evdev_pass_values() In evdev_pass_values(), the input_event structure is allocated on the kernel stack and populated field-by-field. However, it is never fully initialized. On architectures where struct input_event contains explicit or implicit padding (such as the 32-bit __pad field on SPARC64), these padding bytes are left uninitialized. When this event structure is subsequently passed to the client buffer and later copied to userspace, the uninitialized padding bytes leak kernel stack memory, potentially exposing sensitive information. Similar issues exist in __evdev_queue_syn_dropped and __pass_event. Fix this by explicitly zeroing the entire event structure with memset() before populating its fields. This ensures all padding bytes are cleared before the data crosses the security boundary.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel