VulnSea

CWE-200

CVEs classified under CWE-200, newest first.

1541 CVEsRSS

GHSA-f45q-w629-wr25Medium
3mo ago

Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects

▾ Sunlithubuum_client · hubuum_clientvia GHSA
GHSA-p6ph-3jx2-3337Medium· 4.3
3mo ago

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

▾ SunlitOpenListTeam · github.com/OpenListTeam/OpenList/v4via GHSA
GHSA-q53c-4prm-w95qMedium
3mo ago

Shescape: Home-directory disclosure in assignment context on Unix with Dash

Shescape: Home-directory disclosure in assignment context on Unix with Dash

▾ Sunlitshescape · shescapevia GHSA
GHSA-fcrw-f7gg-6g9fMedium· 4.9
3mo ago

Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

Budibase: SSO OAuth2 Token Leakage via User Metadata Endpoints to Power-Role Users

▾ Sunlitbudibase · @budibase/servervia GHSA
GHSA-mqhr-6j6h-74p5Critical
3mo ago

Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak

Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak

▾ Midnightbudibase · @budibase/servervia GHSA
GHSA-hr66-5mqr-8mpxHigh· 7.5
3mo ago

Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

▾ Twilightbudibase · @budibase/servervia GHSA
GHSA-gh4h-34gr-87r7Medium· 5.7
3mo ago

Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

▾ Sunlitbudibase · @budibase/servervia GHSA
CVE-2026-59222Medium
3mo ago

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

Open WebUI: /api/v1/channels/{id}/members exposes full user model including sensitive credentials

▾ Sunlitopen-webui · open-webuiEPSS 0.46%via GHSA
CVE-2026-54673High
3mo ago

electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`

▾ Twilightbuilder-util-runtime · builder-util-runtimeEPSS 0.41%via GHSA
CVE-2026-53467Medium· 5.3
3mo ago

ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged

ImageMagick: Information Disclosure in MNG decoder because allocated memory is left unchanged

▾ SunlitMagick · Magick.NET-Q16-AnyCPUEPSS 0.20%via GHSA
GHSA-2x35-3fw4-9jr4High
3mo ago

n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

▾ Twilightn8n · n8nvia GHSA
CVE-2026-59209High
3mo ago

n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

n8n: Shared Credential Header Leak via HTTP Request Pagination Expression

▾ Twilightn8n · n8nEPSS 0.40%via GHSA
CVE-2026-65009Medium· 4.3PoC
3mo ago

OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm

OpenRemote versions before 1.26.2 contain an information disclosure vulnerability in the SyslogResource REST endpoint that fails to filter operational logs by realm. Attackers with the read:rules role can access the GET /api/{realm}/sysl…

▾ Twilightopenremote · openremoteEPSS 0.23%via NVD
CVE-2026-60812Medium· 6.5
3mo ago

Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-Business Suite (component: Collaboration History)

Vulnerability in the Oracle Supply Chain Trading Connector product of Oracle E-Business Suite (component: Collaboration History). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privi…

▾ Sunlitoracle · e-business_suiteEPSS 0.39%via NVD
CVE-2026-61185High· 7.4
3mo ago

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation)

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticat…

▾ Twilightoracle · agile_product_lifecycle_management_for_processEPSS 0.34%via NVD
CVE-2026-61116High· 7.5
3mo ago

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core)

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with …

▾ Twilightoracle · application_object_libraryEPSS 0.44%via NVD
CVE-2026-60647High· 7.1
3mo ago

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management)

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low priv…

▾ Twilightoracle · webcenter_contentEPSS 0.38%via NVD
CVE-2026-60611Medium· 5.3
3mo ago

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security)

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with …

▾ Sunlitoracle · peoplesoft_enterprise_campus_software_campus_communityEPSS 0.34%via NVD
CVE-2026-60610Medium· 5.9
3mo ago

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security)

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker wit…

▾ Sunlitoracle · peoplesoft_enterprise_campus_software_campus_communityEPSS 0.35%via NVD
CVE-2026-60609Medium· 6.5
3mo ago

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Communication)

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Communication). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker w…

▾ Sunlitoracle · peoplesoft_enterprise_campus_software_campus_communityEPSS 0.39%via NVD
CVE-2026-60558High· 8.1
3mo ago

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated…

▾ Twilightoracle · webcenter_sitesEPSS 0.39%via NVD
CVE-2026-60555Critical· 9.8
3mo ago

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated a…

▾ Midnightoracle · webcenter_sitesEPSS 0.51%via NVD
CVE-2026-60553High· 8.7
3mo ago

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated…

▾ Twilightoracle · webcenter_sitesEPSS 0.34%via NVD
CVE-2026-60552Critical· 9.9
3mo ago

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged at…

▾ Midnightoracle · webcenter_sitesEPSS 0.43%via NVD
CVE-2026-60551Critical· 9.8
3mo ago

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites)

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated a…

▾ Midnightoracle · webcenter_sitesEPSS 0.51%via NVD
CVE-2026-60408Medium· 4.3
3mo ago

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator)

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileg…

▾ Sunlitoracle · timesten_in-memory_databaseEPSS 0.30%via NVD
CVE-2026-60405Low· 3.8
3mo ago

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator)

Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileg…

▾ Sunlitoracle · timesten_in-memory_databaseEPSS 0.15%via NVD
CVE-2026-60395Medium· 4.3
3mo ago

Vulnerability in Oracle GoldenGate (component: Admin Server Executable)

Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows low privileged attacker with …

▾ Sunlitoracle · goldengateEPSS 0.30%via NVD
CVE-2026-60394Medium· 5.3
3mo ago

Vulnerability in Oracle GoldenGate (component: Admin Server Executable)

Vulnerability in Oracle GoldenGate (component: Admin Server Executable). Supported versions that are affected are 21.3-21.21 and 23.4-23.26.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTT…

▾ Sunlitoracle · goldengateEPSS 0.34%via NVD
CVE-2026-60354Low· 3.7
3mo ago

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Data Visualization Tools)

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Data Visualization Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthentic…

▾ Sunlitoracle · jdeveloperEPSS 0.27%via NVD
CWE-200 vulnerabilities (CVEs) — page 35 · VulnSea