CVE-2026-102904 | Medium | 5.4 | 2026-09-29 | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5… |
CVE-2026-100677 | Medium | 5.3 | 2026-09-26 | stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error responses. Unauthentica… |
CVE-2026-4638 | | | 2026-09-24 | PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric val… |
CVE-2026-84499 | High | 7.7 | 2026-09-23 | A flaw was found in Red Hat Ansible Automation Platform's automation-
controller. Survey questions of type password are write-only and stored
encrypted, displa… |
CVE-2026-71463 | Low | 2.7 | 2026-09-23 | Notification template Jinja AST whitelist only inspects
static Getattr nodes. Dynamic subscripts (job['job'+'_env'])
and {% if job… |
CVE-2026-71461 | Medium | 4.3 | 2026-09-23 | HostList.list() catches bare Exception and returns str(e)
verbatim. Via host_filter, any authenticated user triggers
Django FieldEr… |
CVE-2026-4921 | Low | 2.7 | 2026-09-23 | IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2026-3626 | Medium | 5.3 | 2026-09-23 | IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2026-85709 | Medium | 5.3 | 2026-09-22 | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers… |
CVE-2026-1030 | Medium | 4.3 | 2026-09-18 | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes sensitive informat… |
CVE-2025-1350 | Medium | 5.3 | 2026-09-18 | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical… |
CVE-2026-45723 | Low | 2.7 | 2026-09-17 | Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/sch… |
CVE-2026-92936 | Medium | 5.8 | 2026-09-17 | vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the h… |
CVE-2026-55375 | Medium | 5.3 | 2026-09-15 | canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams() places app_id, app_secret, ref… |
CVE-2026-54561 | Medium | 6.2 | 2026-09-15 | MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_import in src/index.ts passes the caller… |
CVE-2026-55102 | | | 2026-09-14 | hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests throug… |
CVE-2026-66306 | Medium | 6.5 | 2026-09-08 | Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network. |
CVE-2026-69684 | Medium | 5.5 | 2026-09-08 | Generation of error message containing sensitive information in Windows Error Reporting allows an authorized attacker to disclose information locally. |
CVE-2026-69552 | Medium | 5.7 | 2026-09-08 | Generation of error message containing sensitive information in Windows Print Spooler Components allows an authorized attacker to disclose information over a n… |
CVE-2026-69294 | Medium | 5.5 | 2026-09-08 | Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally. |
CVE-2026-68886 | Medium | 5.5 | 2026-09-08 | Use after free in Windows Network Connection Broker allows an authorized attacker to disclose information locally. |
CVE-2026-67383 | Medium | 6.5 | 2026-09-08 | Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network. |
CVE-2026-11873 | Medium | 6.5 | 2026-09-01 | An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malf… |
CVE-2026-82739 | | | 2026-09-01 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who f… |
CVE-2026-82733 | | | 2026-09-01 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to read internal ap… |
CVE-2026-77950 | | | 2026-09-01 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker to receive unredact… |
CVE-2026-82727 | | | 2026-08-31 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_phoenix writes the entire raw submitted param map into an excepti… |
CVE-2026-82580 | | | 2026-08-31 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users.
In AshAi.ToolLoo… |
CVE-2026-75760 | | | 2026-08-31 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-fac… |
CVE-2026-78693 | | | 2026-08-30 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_graphql allows a remote client to read internal field names that… |
CVE-2026-59271 | Medium | 5.3 | 2026-08-27 | When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message.
Spring AMQP 4.1.0
S… |
CVE-2026-47893 | High | 7.5 | 2026-08-27 | A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception… |
CVE-2026-21809 | Low | 3.9 | 2026-08-26 | HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can… |
CVE-2026-79777 | Low | 2.7 | 2026-08-25 | rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, modu… |
CVE-2026-8173 | Medium | 5.3 | 2026-08-24 | The web GUI of affected Murrelektronik Xelity switches logs MAC addresses from the devices MAC address table when an authenticated administrator uses the 'Copy… |
CVE-2026-33333 | Low | 3.5 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is sensitive information disclosure in the error messages. This issue has been fi… |
CVE-2026-77076 | Medium | 6.5 | 2026-08-20 | n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the conne… |
CVE-2026-53458 | | | 2026-08-18 | Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in custom_componen… |
CVE-2026-74879 | High | 7.5 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to un… |
CVE-2026-73844 | Low | 3.7 | 2026-08-14 | CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messag… |
CVE-2026-73555 | Medium | 5.3 | 2026-08-13 | vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py… |
CVE-2026-56620 | Medium | 4.3 | 2026-08-10 | HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting. |
CVE-2026-43630 | Medium | 6.5 | 2026-08-06 | llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write ac… |
CVE-2026-47622 | Medium | 5.3 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause the generation of error messages that contain sensitive information. A successfu… |
CVE-2026-69247 | | | 2026-08-03 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7_decrypt_der, pkcs7_decr… |
CVE-2026-56571 | Low | 3.7 | 2026-07-31 | HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavail… |
CVE-2026-56568 | Low | 3.7 | 2026-07-31 | HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/A… |
CVE-2026-11904 | Medium | 5.3 | 2026-07-30 | IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0… |
CVE-2026-59943 | Medium | 5.3 | 2026-07-28 | Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can u… |
CVE-2025-59177 | | | 2026-07-27 | Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically… |
CVE-2026-56537 | Low | 3.5 | 2026-07-27 | HCL Connections is vulnerable to information disclosure which could allow a user to obtain sensitive information they are not entitled to, caused by improper h… |
CVE-2026-66009 | | | 2026-07-24 | Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields… |
CVE-2026-66008 | | | 2026-07-24 | Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL validation and… |
CVE-2026-13182 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failure… |
CVE-2026-64627 | | | 2026-07-21 | Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with… |
CVE-2026-63748 | Medium | 4.3 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by fi… |
CVE-2026-8861 | Medium | 5.3 | 2026-07-17 | IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This inf… |
CVE-2024-23575 | Medium | 5.3 | 2026-07-17 | HCL Aftermarket EPC is vulnerable to attack since the application returns detailed error messages that leak information about the processing on the server. An… |
CVE-2026-56139 | Medium | 5.3 | 2026-07-06 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component.
The camel-undertow HTTP server consumer exposes… |
CVE-2026-49365 | Medium | 5.3 | 2026-07-06 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component.
The camel-netty-http HTTP server consumer exp… |
CVE-2026-53906 | High | 8.2 | 2026-07-01 | MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename p… |
CVE-2026-56331 | Medium | 5.3 | 2026-06-30 | Capgo before 12.128.2 contains improper error handling in the /private/accept_invitation endpoint that returns HTTP 500 instead of safe 4xx errors when magic_i… |
CVE-2025-36328 | Medium | 4.3 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message… |
CVE-2026-47775 | Medium | 6.8 | 2026-06-26 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, the OAuth2 HTTP filter's e… |
CVE-2026-49979 | Low | 2.7 | 2026-06-24 | Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-c… |
CVE-2025-59872 | Medium | 4.3 | 2026-06-17 | HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possible to obtain comman… |
CVE-2026-47248 | | | 2026-06-12 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.78 and 9.9.1-alpha.2, Parse Serve… |
CVE-2026-40997 | Medium | 5.3 | 2026-06-11 | Several Spring WS integration paths with Spring Security could surface detailed account state (for example locked or disabled user semantics) to remote SOAP cl… |
CVE-2026-41730 | Medium | 5.3 | 2026-06-10 | Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients.
… |
CVE-2025-52611 | Low | 3.1 | 2026-06-04 | HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in… |
CVE-2025-52606 | Medium | 4.3 | 2026-06-04 | HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security tactic. Received i… |
CVE-2026-9794 | Medium | 5.3 | 2026-05-28 | A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests to the SAML ECP (Sec… |
CVE-2026-42459 | High | 7.5 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET… |
CVE-2026-1248 | Medium | 4.3 | 2026-05-27 | IBM Business Automation Workflow containers and traditional may leak information about its database structure in error messages. |
CVE-2024-28765 | Medium | 5.3 | 2026-05-27 | IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2 could allow a remote attacker to obtain sensitive information… |
CVE-2026-9583 | Medium | 4.3 | 2026-05-26 | A weakness has been identified in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This impacts an unknown function of the file /i… |
CVE-2026-45728 | High | 7.5 | 2026-05-26 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode… |
CVE-2026-5511 | Low | 2.7 | 2026-05-19 | In the web management interface of Archer AX72 (SG) v1, the network diagnostic feature improperly handles invalid user input, resulting in limited exposure of… |
CVE-2026-7860 | | | 2026-05-19 | A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables i… |
CVE-2026-41935 | High | 7.1 | 2026-05-14 | Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission()… |
CVE-2026-42552 | High | 7.5 | 2026-05-13 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the default error handler Engine::_error() writes the full exception message, exception code… |
CVE-2026-44002 | Medium | 5.8 | 2026-05-13 | vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThi… |
CVE-2026-43873 | High | 7.5 | 2026-05-11 | WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/CloneSite/cloneClient.json.php echoes the local CloneSite shared sec… |
CVE-2026-44226 | Medium | 5.3 | 2026-05-11 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, pyload-ng WebUI returns full Python traceback details to clients… |
CVE-2026-41644 | High | 7.1 | 2026-05-07 | monetr is a budgeting application for recurring expenses. Prior to version 1.12.5, a server-side request forgery (SSRF) vulnerability in monetr's Lunch Flow in… |
CVE-2026-41931 | Medium | 5.3 | 2026-05-06 | Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by t… |
CVE-2025-31960 | Medium | 5.3 | 2026-05-06 | HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was observed that suppl… |
CVE-2025-59853 | Low | 3.1 | 2026-05-06 | HCL DFXAnalytics is affected by an Improper Error Handling vulnerability where the application exposes detailed stack traces in responses, which could allow an… |
CVE-2026-40969 | Low | 3.7 | 2026-04-28 | The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an at… |
CVE-2026-3259 | | | 2026-04-23 | A Generation of Error Message Containing Sensitive Information vulnerability in the Materialized View Refresh mechanism in Google BigQuery on Google Cloud Plat… |
CVE-2026-40245 | High | 7.5 | 2026-04-16 | Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions 4.2.1 and below contain an information disclosure vul… |
CVE-2025-52641 | Low | 2.9 | 2026-04-15 | HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information m… |
CVE-2026-29146 | High | 7.5 | 2026-04-09 | Padding Oracle vulnerability in Apache Tomcat's EncryptInterceptor with default configuration.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1… |
CVE-2025-14243 | Medium | 5.3 | 2026-04-08 | A flaw was found in the OpenShift Mirror Registry. This vulnerability allows an unauthenticated, remote attacker to enumerate valid usernames and email address… |
CVE-2026-24511 | Medium | 4.4 | 2026-04-08 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0, contains a generation of error message containing sensitive in… |
CVE-2026-34045 | High | 8.2 | 2026-04-07 | Podman Desktop is a graphical tool for developing on containers and Kubernetes. Prior to 1.26.2, an unauthenticated HTTP server exposed by Podman Desktop allow… |
CVE-2025-71282 | High | 7.5 | 2026-04-01 | XenForo before 2.3.7 discloses filesystem paths through exception messages triggered by open_basedir restrictions. This allows an attacker to obtain informatio… |
CVE-2026-4994 | Low | 3.5 | 2026-03-28 | A vulnerability was found in wandb OpenUI up to 1.0/3.5-turb. Affected is the function generic_exception_handler of the file backend/openui/server.py of the co… |
CVE-2026-28786 | Medium | 4.3 | 2026-03-27 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, an unsanitized filename field in the… |
CVE-2026-2484 | Medium | 4.3 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information exposure vulnerability caused by overly verbose error messages |