CWE-203

▾ Twilightdgtlmoon · changedetection.ioEPSS 0.44%via NVD

A flaw has been found in dgtlmoon changedetection.io up to 0.60.7

A flaw has been found in dgtlmoon changedetection.io up to 0.60.7. The affected element is the function check_password of the file changedetectionio/flask_app.py of the component Hash Comparison. This manipulation of the argument Passwor…

CVE-2026-91725Medium· 5.3

▾ Sunlitgoogle · chromeEPSS 0.24%via NVD

Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page

Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-91714Medium· 5.3

▾ Sunlitgoogle · chromeEPSS 0.24%via NVD

Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page

Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-56888Medium· 6.2

▾ Sunlitgoogle · androidEPSS 0.10%via NVD

In multiple locations, there is a possible permission bypass due to side channel information disclosure

In multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for …

CVE-2025-5802Medium· 5.3

▾ SunlitWSO2 · WSO2 API ManagerEPSS 0.33%via NVD

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence

The self-registration flow accepts user-supplied input for usernames without adequately preventing the disclosure of username existence. When a user attempts to register with an existing username, the system responds with an error messag…

CVE-2025-13166Low· 3.7

▾ SunlitWSO2 · WSO2 Identity ServerEPSS 0.27%via NVD

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an …

The SMS OTP flow fails to adequately handle error messages, allowing an attacker to infer the existence of registered user accounts based on the responses received during the OTP initiation process. This weakness can be exploited by an …

CVE-2026-59341Medium· 4.2PoC

▾ TwilightBitnami · sealed-secretsEPSS 0.40%via NVD

A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints

A security vulnerability exists in the Sealed Secrets controller's unauthenticated POST endpoints. By submitting a modified payload containing custom Go template logic in spec.template.data, an attacker with internal network access can a…

CVE-2026-87478Medium· 6.5⚖ disputed

Observable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page

Observable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87539Low· 3.1

▾ Sunlitgoogle · chromeEPSS 0.23%via NVD

Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page

Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87516Medium· 4.3⚖ disputed

▾ Sunlitgoogle · chromeEPSS 0.26%via NVD

Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page

Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87518Medium· 5.3

▾ Sunlitgoogle · chromeEPSS 0.28%via NVD

Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page

Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. (Chromium se…

CVE-2026-87623Medium· 6.5⚖ disputed

Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page

Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87566Medium· 5.3

▾ Sunlitgoogle · chromeEPSS 0.28%via NVD

Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page

Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-87620Medium· 6.5⚖ disputed

Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page

Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87619Medium· 4.3

▾ Sunlitgoogle · chromeEPSS 0.26%via NVD

Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page

Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-87459Medium· 6.5⚖ disputed

Observable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page

Observable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-53933Medium· 6.9

▾ Sunlitmacropay-solutions · maravel-frameworkEPSS 0.54%via NVD

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders (e.g., `/api/v1/users/{id}`), the raw string pl…

CVE-2026-55227Medium· 4.3

▾ Sunlitweblate · weblateEPSS 0.32%via OSV

Private Weblate projects vulnerable to observable object existence disclosure via globally scoped object lookups

CVE-2026-78949Low· 2.9

▾ SunlitGoogle · ChromeEPSS 0.11%via CVEORG

Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app

Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium)

CVE-2026-78936Low· 2.9

▾ SunlitGoogle · ChromeEPSS 0.11%via CVEORG

Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app

CVE-2026-72699Medium· 5.3

▾ SunlitEPSS 0.26%via NVD

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address alread…

GHSA-8fxq-53rx-ph5fLow· 3.7

▾ Sunlitcoder · github.com/coder/coder/v2via GHSA

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

CVE-2026-23931Medium· 4.3⚖ disputed

▾ Sunlitzabbix · zabbixEPSS 0.31%via NVD

The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality.

CVE-2026-23937Medium· 6.5

▾ Sunlitzabbix · zabbixEPSS 0.38%via NVD

The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity.

GHSA-vg9q-fc8f-43f3Medium· 5.8

▾ Sunlitsiyuan-note · github.com/siyuan-note/siyuan/kernelvia GHSA

Duplicate Advisory: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

CVE-2026-73409None