Все уязвимости

A vulnerability was found in the Linux kernel's EBPF verifier when handling internal data...

Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-259

Information disclosure vulnerability in the cloud-client daemon of Deco BE63

PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking

PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats

A vulnerability classified as problematic was found in SourceCodester Best Online News Portal 1.0. A

Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.

Apache Answer: Missing Authorization Allows Mutations of Non-Public Content

Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata

Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles

Backstage: Improper input validation in scaffolder task list ordering

pagetriagelist discloses suppressed reviewer usernames

An exposure of sensitive information through data queries vulnerability in Desktop API in Synology D

Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Improper input validation and Exposure of sensitive information through data queries vulnerability i

Potential information leakage from manager /network/graph API in NeuVector

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Cleartext Storage of Username and Password in Finrota's Netahsilat

Apache Syncope: JexlContextBuilder Information Disclosure

Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication

e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action

NextScripts: Social Networks Auto-Poster <= 4.4.3 - Authenticated(Subscriber+) Sensitive Information Exposure

InvenTree Vulnerable to ORM Filter Injection

Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy

Unauthenticated Craft CMS users can trigger a database backup

Users are able to find users by name even when `enable_names` is off

phpMyFAQ has unauthenticated config backup download via /api/setup/backup

Langfuse vulnerable to cross‑organization enumeration of member & invitation lists via project membership APIs

Dragonfly allows arbitrary file read and write on a peer machine

Paid Memberships Pro - Member Directory Add On < 1.2.6 - Contributor+ Sensitive Information Disclosure via SQLi