A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.
When proxy credentials are embedded in the proxy URL, they may be exposed through error handling paths and captured by logs, diagnostics, or other error consumers.
This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.
Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine (`/admin/queries/execute`) accepts a JSON DSL (`from` / `select` / `filters` / `traverse` / `output`), translates it into an Eloquent query, and returns results as JSON. The controller method `QueryController::execute()` does not enforce an authorization gate, unlike `store()` and `massDestroy()` in the same controller which are correctly protected. As a result, any authenticated account — including the read-only Auditor role — can query models beyond its intended scope, including the `User` model. Additionally, the `password` column, although declared `$hidden`, is not excluded from filter predicates, which allows it to be used in `LIKE` conditions. The `schema()` and `schemaModel()` endpoints of the same controller are similarly unguarded. The Query Engine is read-only; integrity and availability are not affected. Version 2025.05.19 patches the issue.
A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions.
We have already fixed the vulnerability in the following version:
QuMagie 2.9.0 and later
Apache Answer versions up to and including 2.0.0 contain a vulnerability where timeline-related APIs do not enforce proper authorization checks. This flaw allows authenticated users to access deleted, private, or unapproved content and its revision history. The issue is fixed in version 2.0.1. The vulnerability has a medium severity with a CVSS score of 6.1.
A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile application and grant himself full access to the device owner's account by interacting with application's push notification.
This issue was fixed in version 4.4.3
Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiBurada allows Authentication Bypass.
This issue affects WifiBurada: through 21052026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can restore a volume from any other user's backups and attach the volume to their own VMs.
Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.
The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0.0+ environments, where this plugin is enabled and have access to specific APIs can create new VMs using backups of any other user of the environment.
Backup plugin users using CloudStack 4.21.0.0+ are recommended to upgrade to CloudStack version 4.22.0.1, which fixes this issue.
Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability in MeWare Software Development Inc. PDKS allows Excavation.
This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.
CVE-2026-41182 is a vulnerability in the langchain-ai langsmith-sdk JavaScript and Python SDKs prior to versions 0.5.19 and 0.7.31 respectively. The issue arises because output redaction controls do not apply to streaming token events, allowing raw token values from streaming LLM outputs to be recorded and stored without redaction. This results in unintended exposure of sensitive information through run event data. The vulnerability has a CVSS score of 5.3, indicating medium severity. Fixed versions are available that address this issue by properly applying redaction to streaming events.
CVE-2025-15623 is a critical vulnerability in Sparx Systems Pty Ltd. 's Sparx Pro Cloud Server version 6.0.163 that allows an unauthenticated user to retrieve the database password in plaintext under certain conditions. This exposure of private personal and sensitive system information could lead to unauthorized access and compromise of the system. The vulnerability has a high CVSS 4.0 score of 9.3, indicating critical severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: "include" })` is used. This can leak cookies from origin A to destination B. Version 20.8.9 fixes the issue.
Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, email, or phone number metadata.
CVE-2026-24321 is a medium-severity vulnerability in SAP Commerce Cloud that allows unauthenticated users to access multiple API endpoints exposing sensitive personal information. The flaw stems from improperly secured APIs that do not require authentication, enabling attackers to retrieve data not intended for public access. While the vulnerability impacts confidentiality, it does not affect data integrity or system availability. The CVSS score of 5.3 reflects the ease of exploitation without authentication and the limited confidentiality impact. No known exploits are currently reported in the wild. European organizations using affected SAP Commerce Cloud versions (HY_COM 2205, COM_CLOUD 2211, 2211-JDK21) should prioritize reviewing API exposure and applying vendor patches or mitigations once available. Countries with significant SAP Commerce Cloud deployments and critical e-commerce infrastructure are at higher risk. Mitigation should focus on restricting API access, implementing strong authentication, and monitoring for unusual API requests.
CVE-2025-66605 is a low-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue arises because certain input fields on the web interface have the autocomplete attribute enabled, causing sensitive input data to be stored in the user's browser. This behavior can lead to unintended data exposure if the browser's stored data is accessed by unauthorized parties. The vulnerability does not require authentication but does require user interaction, and it has a low impact on confidentiality with no impact on integrity or availability. No known exploits are currently in the wild, and no patches have been released yet. European organizations using FAST/TOOLS, especially in critical infrastructure sectors, should be aware of this risk and take steps to mitigate potential data leakage through browser autocomplete features.
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.7.1.
An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized user to retrieve restricted or sensitive information.
Users are recommended to upgrade to version 2.0.0, which fixes the issue.
In mObywatel iOS application an unauthorized user can use the App Switcher to view the account owner's personal information in the minimized app window, even after the login session has ended (reopening the app would require the user to log in). The data exposed depends on the last application view displayed before the application was minimized
This issue was fixed in version 4.71.0
In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Server does not verify the permissions required to obtain the data.
This issue was fixed in version 915 (Android) and 7.4.1 (iOS).
An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated attacker using M-Files Web to capture session tokens of other active users.