CVE-2026-19229 | Medium | 5.3 | 2026-08-07 | A vulnerability was determined in SourceCodester Online Clothing Store. Affected by this issue is some unknown functionality of the file /_notes/ of the compon… |
CVE-2026-12762 | Medium | 5.3 | 2026-08-05 | IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a remote attacker to obtain sensitive information exposed in manifest file… |
CVE-2026-15574 | High | 7.5 | 2026-07-13 | A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and full chat payloads, whi… |
CVE-2025-36372 | Medium | 5.5 | 2026-06-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information to an a… |
CVE-2026-50099 | Medium | 4.6 | 2026-06-12 | During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on produc… |
CVE-2026-50565 | Medium | 4.9 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-46617 | | | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-29114 | | | 2026-06-10 | A vulnerability has been found in some Dahua products. An attacker
may obtain the device’s CA root certificate. If that CA is installed and
trusted on client s… |
CVE-2019-25717 | Medium | 4.3 | 2026-06-02 | Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain an information disclosure vulnerability that allows unauthenticated network attackers to ac… |
CVE-2026-10254 | Medium | 5.3 | 2026-06-01 | A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. Affected is an unknown function of the file /admin/. This manipulation causes fil… |
CVE-2026-49298 | High | 8.8 | 2026-06-01 | A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to the worker contain… |
CVE-2026-5434 | Medium | 5.9 | 2026-05-21 | Honeywell Control
Network Module (CNM) contains
insertion of sensitive information into an unintended directory. An attacker could exploit this vulnerability t… |
CVE-2026-27173 | High | 8.7 | 2026-05-19 | JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users wit… |
CVE-2023-54346 | High | 7.5 | 2026-05-05 | WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database ba… |
CVE-2026-7071 | Medium | 5.3 | 2026-04-27 | A security vulnerability has been detected in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /users/us… |
CVE-2026-6160 | Medium | 5.3 | 2026-04-13 | A vulnerability was found in code-projects Simple ChatBox 1.0. Affected by this issue is the function SimpleChatbox_PHP of the file chatbox.sql of the componen… |
CVE-2019-25706 | High | 7.5 | 2026-04-12 | Across DR-810 contains an unauthenticated file disclosure vulnerability that allows remote attackers to download the rom-0 backup file containing sensitive inf… |
CVE-2026-33705 | Medium | 5.3 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authent… |
CVE-2025-36051 | Medium | 6.2 | 2026-03-19 | IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 stores potentially sensitive information in configuration files that could be read by a local user. |
CVE-2025-52642 | Low | 3.3 | 2026-03-16 | HCL AION is affected by a vulnerability where internal filesystem paths may be exposed through application responses or system behaviour. Exposure of internal… |
CVE-2016-20024 | Critical | 9.8 | 2026-03-16 | ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to escalate privileges by modifying executable fil… |
CVE-2026-21672 | High | 8.8 | 2026-03-12 | A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers. |
CVE-2026-2817 | Medium | 4.4 | 2026-02-19 | Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On sh… |
CVE-2020-37104 | High | 7.5 | 2026-02-11 | ASTPP 4.0.1 contains an information disclosure vulnerability that allows unauthenticated attackers to download database backup files by predicting backup filen… |
CVE-2025-12059 | Critical | 9.8 | 2026-02-11 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Logo Software Industry and Trade Inc. Logo j-Platform allows E… |
CVE-2025-12699 | Medium | 5.5 | 2026-02-10 | The ZOLL ePCR IOS application reflects unsanitized user input into a WebView. Attacker-controlled strings placed into PCR fields (run number, incident, call si… |
CVE-2025-36058 | Medium | 5.5 | 2026-01-20 | IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix… |
CVE-2026-23838 | | | 2026-01-19 | Tandoor Recipes is a recipe manager than can be installed with the Nix package manager. Starting in version 23.05 and prior to version 26.05, when using the de… |
CVE-2025-68429 | High | 7.3 | 2025-12-17 | Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to… |
CVE-2025-61138 | High | 7.5 | 2025-11-20 | Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory. |
CVE-2021-4471 | | | 2025-11-14 | TG8 Firewall exposes a directory such as /data/ over HTTP without authentication. This directory stores credential files for previously logged-in users. A remo… |
CVE-2016-15056 | | | 2025-11-14 | Ubee EVW3226 cable modem/routers firmware versions up to and including 1.0.20 store configuration backup files in the web root after they are generated for dow… |
CVE-2025-11891 | Medium | 5.3 | 2025-11-11 | The Shelf Planner plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.8.1 through publicly exposed log… |
CVE-2025-46602 | Medium | 4.4 | 2025-10-27 | Dell SupportAssist OS Recovery, versions prior to 5.5.15.0, contain an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerab… |
CVE-2025-11079 | Medium | 5.3 | 2025-09-27 | A security flaw has been discovered in Campcodes Farm Management System 1.0. Affected by this issue is some unknown functionality. The manipulation results in… |
CVE-2025-58458 | Medium | 4.3 | 2025-09-03 | In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path… |
CVE-2025-57734 | Medium | 4.3 | 2025-08-20 | In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files |
CVE-2025-8452 | Medium | 4.3 | 2025-08-12 | By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Brot… |
CVE-2024-51977 | Medium | 5.3 | 2025-06-25 | An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak… |
CVE-2025-46820 | High | 7.1 | 2025-05-06 | phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflo… |
CVE-2025-20665 | Medium | 5.5 | 2025-05-05 | In devinfo, there is a possible information disclosure due to a missing SELinux policy. This could lead to local information disclosure of device identifier wi… |
CVE-2025-31421 | Medium | 5.8 | 2025-04-04 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Oblak Studio Srbtranslatin srbtranslatin allows Retrieve Embed… |
CVE-2025-31558 | Medium | 5.8 | 2025-04-03 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Greg TailPress tailpress allows Retrieve Embedded Sensitive Da… |
CVE-2025-31550 | Medium | 5.8 | 2025-04-01 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in thom4 WP-LESS wp-less allows Retrieve Embedded Sensitive Data… |
CVE-2025-25586 | Medium | 4.2 | 2025-03-18 | yimioa before v2024.07.04 was discovered to contain an information disclosure vulnerability via the component /resources/application.yml. |
CVE-2025-27017 | Medium | 6.5 | 2025-03-12 | Apache NiFi 1.13.0 through 2.2.0 includes the username and password used to authenticate with MongoDB in the NiFi provenance events that MongoDB components gen… |
CVE-2025-27150 | Medium | 5.3 | 2025-03-04 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from… |
CVE-2025-22633 | Medium | 5.8 | 2025-02-23 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in StellarWP Give – Divi Donation Modules give-donation-modules-f… |
CVE-2025-24689 | Medium | 5.9 | 2025-01-27 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Javier Carazo Import and export users and customers import-use… |
CVE-2025-22773 | Medium | 5.3 | 2025-01-15 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Expl… |
CVE-2024-6880 | | | 2025-01-10 | During MegaBIP installation process, a user is encouraged to change a default path to administrative portal, as keeping it secret is listed by the author as on… |
CVE-2025-0194 | Medium | 6.5 | 2025-01-08 | An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 p… |
CVE-2025-22306 | Medium | 5.3 | 2025-01-07 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Spencer Haws Link Whisper Free link-whisper.This issue affects… |
CVE-2024-47580 | Medium | 6.8 | 2024-12-10 | An attacker authenticated as an administrator can use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an inter… |
CVE-2024-47579 | Medium | 6.8 | 2024-12-10 | An attacker authenticated as an administrator can use an exposed webservice to upload or download a custom PDF font file on the system server. Using the uploa… |
CVE-2022-43933 | Medium | 4.4 | 2024-11-21 | An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in supports… |
CVE-2023-7062 | High | 8.8 | 2024-07-10 | The Advanced File Manager Shortcodes plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.4. This makes it possibl… |
CVE-2023-5937 | Low | 3.8 | 2024-05-15 | On Windows systems, the Arc configuration files resulted to be world-readable.
This can lead to information disclosure by local attackers, via exfiltration… |
CVE-2024-31954 | High | 7.3 | 2024-05-14 | An issue was discovered in the installer in Samsung Portable SSD for T5 1.6.10 on Windows. Because it is possible to tamper with the directory and DLL files us… |
CVE-2024-22045 | High | 7.6 | 2024-03-12 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.1 SP1). The product places sensitive information into files or directori… |
CVE-2024-21501 | Medium | 5.3 | 2024-02-24 | Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allow… |
CVE-2024-22433 | High | 8.8 | 2024-02-06 |
Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info in DP Search. A remot… |
CVE-2024-0191 | Medium | 5.3 | 2024-01-02 | A vulnerability was found in RRJ Nueva Ecija Engineer Online Portal 1.0. It has been classified as problematic. Affected is an unknown function of the file /ad… |
CVE-2023-4595 | High | 7.5 | 2023-11-23 | An information exposure vulnerability has been found, the exploitation of which could allow a remote user to retrieve sensitive information stored on the serve… |
CVE-2023-46723 | High | 8.9 | 2023-10-31 | lte-pic32-writer is a writer for PIC32 devices. In versions 0.0.1 and prior, those who use `sendto.txt` are vulnerable to attackers who known the IMEI reading… |
CVE-2022-4318 | High | 7.8 | 2023-09-25 | A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable. |
CVE-2023-38558 | Medium | 5.5 | 2023-09-14 | A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration Console) V4.0 Update 1 (Al… |
CVE-2023-4480 | Medium | 5.5 | 2023-09-05 |
Due to an out-of-date dependency in the “Fusion File Manager” component accessible through the admin panel, an attacker can send a crafted request that allows… |
CVE-2023-28444 | Critical | 9.9 | 2023-03-24 | angular-server-side-configuration helps configure an angular application at runtime on the server or in a docker container via environment variables. angular-s… |
CVE-2022-26329 | Low | 1.8 | 2023-01-26 | File existence disclosure vulnerability in NetIQ Identity Manager plugin prior to version 4.8.5 allows attacker to determine whether a file exists on the files… |
CVE-2022-23508 | High | 8.8 | 2023-01-09 | Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability i… |
CVE-2022-44623 | Medium | 6.5 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings |
CVE-2022-20864 | Medium | 4.6 | 2022-10-10 | A vulnerability in the password-recovery disable feature of Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco Catalyst Switches could allow an unauthenticat… |
CVE-2021-40363 | High | 7.8 | 2022-02-09 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMA… |
CVE-2022-0013 | Medium | 5.0 | 2022-01-12 | A file information exposure vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker to read the contents of arbitrary fil… |
CVE-2021-3709 | Medium | 6.5 | 2021-10-01 | Function check_attachment_for_errors() in file data/general-hooks/ubuntu.py could be tricked into exposing private data via a constructed crash file. This issu… |
CVE-2021-32822 | Medium | 4.0 | 2021-08-16 | The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. Th… |
CVE-2021-1406 | Medium | 4.9 | 2021-04-08 | A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could… |
CVE-2021-21250 | High | 7.7 | 2021-01-15 | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpe… |
CVE-2019-15793 | Medium | 6.5 | 2020-04-24 | In shiftfs, a non-upstream patch to the Linux kernel included in the Ubuntu 5.0 and 5.3 kernel series, several locations which shift ids translate user/group i… |
CVE-2019-6851 | High | 7.5 | 2019-10-29 | A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions… |
CVE-2019-7618 | Medium | 6.5 | 2019-10-01 | A local file disclosure flaw was found in Elastic Code versions 7.3.0, 7.3.1, and 7.3.2. If a malicious code repository is imported into Code it is possible to… |
CVE-2019-12623 | Medium | 4.3 | 2019-08-21 | A vulnerability in the web server functionality of Cisco Enterprise Network Functions Virtualization Infrastructure Software (NFVIS) could allow an authenticat… |
CVE-2018-20932 | Low | 2.7 | 2019-08-01 | cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains (SEC-406). |
CVE-2019-10320 | Medium | 4.3 | 2019-05-21 | Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins ma… |
CVE-2018-11798 | Medium | 6.5 | 2019-01-07 | The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user ha… |
CVE-2018-16970 | Medium | 4.3 | 2018-09-12 | Wisetail Learning Ecosystem (LE) through v4.11.6 allows insecure direct object reference (IDOR) attacks to download non-purchased course files via a modified i… |
CVE-2017-5387 | Low | 3.3 | 2018-06-11 | The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "source" attribute on a "<track>" tag refe… |
CVE-2018-10590 | High | 7.5 | 2018-05-15 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada… |
CVE-2018-4847 | Medium | 4.6 | 2018-04-23 | A vulnerability has been identified in SIMATIC WinCC OA Operator iOS App (All versions < V1.4). Insufficient protection of sensitive information (e.g. session… |
CVE-2017-16770 | Medium | 6.5 | 2018-02-27 | File and directory information exposure vulnerability in SYNO.SurveillanceStation.PersonalSettings.Photo in Synology Surveillance Station before 8.1.2-5469 all… |
CVE-2017-9947 | Medium | 5.3 | 2017-10-23 | A vulnerability has been identified in Siemens APOGEE PXC and TALON TC BACnet Automation Controllers in all versions <V3.5. A directory traversal vulnerability… |
CVE-2016-10399 | High | 7.5 | 2017-07-27 | Sendio versions before 8.2.1 were affected by a Local File Inclusion vulnerability that allowed an unauthenticated, remote attacker to read potentially sensiti… |
CVE-2014-0772 | | | 2014-04-12 | The BWOCXRUN.BwocxrunCtrl.1 control contains a method named
OpenUrlToBufferTimeout. This method takes a URL as a parameter and
returns its contents to the ca… |
CVE-2014-0771 | | | 2014-04-12 | The BWOCXRUN.BwocxrunCtrl.1 control contains a method named
“OpenUrlToBuffer.” This method takes a URL as a parameter and returns
its contents to the caller… |