CVE Database and Vulnerability Search

Browse vendorsBrowse ecosystems

Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.

Vulnerabilities
381,276
with PoCs
37,250
CISA KEV
1,665
Ransomware
606
with Nuclei
4,342
Advanced

Showing 13 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.

CWE-1258Aug 13, 2026
CVSS7.5v3.1EPSS-PoCs0SignalsSTIX

WordPress JetBlog plugin <= 2.4.8 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in JetBlog <= 2.4.8 versions.

CWE-1258Jun 17, 2026
CVSS7.5v3.1EPSS0.238%PoCs0SignalsSTIX

Senstive information disclosure was affecting subiquity

In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs.

CWE-1258Apr 9, 2026
CVSS2.7v4.0EPSS0.278%PoCs0SignalsSTIX

Senstive information disclosure was affecting ubuntu-desktop-provision

In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.

CWE-1258Apr 9, 2026
CVSS2.7v4.0EPSS0.307%PoCs0SignalsSTIX

Dell Integrated Dell Remote Access Controller Exposure of Sensitive System Information Due to Uncleared Debug Information

Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.174, 15G and 16G versions prior to 7.10.90.00, contain an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.

CWE-1258Mar 18, 2026
CVSS4.9v3.1EPSS0.291%PoCs0SignalsSTIX

Dell PowerEdge Server BIOS and Dell iDRAC9, all versions, contains an Information Disclosure vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information Disclosure.

CWE-1258Sep 25, 2025
CVSS4.9v3.1EPSS0.286%PoCs0SignalsSTIX

WordPress 1 Click WordPress Migration plugin <= 2.5.7 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration 1-click-migration allows Retrieve Embedded Sensitive Data.This issue affects 1 Click WordPress Migration: from n/a through <= 2.5.7.

CWE-1258Apr 4, 20251 related artifact
CVSS5.3v3.1EPSS0.801%PoCs0SignalsSTIX

Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Leak pages if set_memory_encrypted() fails In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. VMBus code coul…

CWE-1258May 30, 2024
CVSS9.3v3.1EPSS0.652%PoCs0SignalsSTIX

Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl In CoCo VMs it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. In order to make sur…

CWE-1258May 30, 2024
CVSS9.6v3.1EPSS0.957%PoCs0SignalsSTIX

Calendar app returns full stacktrace when an error happens while editing appointment

Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5.3

CWE-1258CWE-212Dec 21, 2023
CVSS3.5v3.1EPSS0.547%PoCs0SignalsSTIX

Exposure of sensitive system information due to uncleared debug information for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local access.

CWE-1258Nov 14, 2023
CVSS3.3v3.1EPSS0.216%PoCs0SignalsSTIX

Exposure of sensitive Slack webhook URLs in debug logs and traces

Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain private information. The problem is fixed in version 1.3.2 which redacts sensitive URLs for webhooks. As a workaround, people who use Slack webhooks may disable or filter debug logs.

CWE-1258Oct 10, 2022
CVSS7.5v3.1EPSS0.719%PoCs0SignalsSTIX

Slack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logs

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive information in application logs. As a workaround, do not print/output requests and responses for OAuth and client configurations in logs.

CWE-1258CWE-200CWE-212Jul 21, 2022
CVSS7.5v3.1EPSS0.872%PoCs0SignalsSTIX