CVE Database and Vulnerability Search

Browse vendorsBrowse ecosystems

Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.

Vulnerabilities
381,276
with PoCs
37,250
CISA KEV
1,665
Ransomware
606
with Nuclei
4,342
Advanced

Showing 7 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

### Summary The GoCardless components in Actualbudget in are logging responses to STDOUT in a parsed format using `console.log`and `console.debug` (Which in this version of node is an alias for `console.log`). This is exposing sensitive information in log files including, but not limited to: - Gocardless bearer tokens. - Account IBAN and Bank Account numbers. - PII of the account holder. - Transaction details (Payee bank information, Recipient account numbers, Transaction IDs)... ### Details …

CWE-209CWE-215CWE-219Oct 20, 2025
CVSS-v3.1EPSS-PoCs0SignalsSTIX

Server source code is exposed to the public if sourcemaps are enabled

Astro is a web framework for content-driven websites. A bug in the build process allows any unauthenticated user to read parts of the server source code. During build, along with client assets such as css and font files, the sourcemap files **for the server code** are moved to a publicly-accessible folder. Any outside party can read them with an unauthorized HTTP GET request to the same server hosting the rest of the website. While some server files are hashed, making their access obscure, the f…

CWE-219Dec 19, 20241 related artifact
CVSS7.8v4.0EPSS1.49%PoCs0SignalsSTIX

Avtec Outpost Storage of File with Sensitive Data Under Web Root

Avtec Outpost stores sensitive information in an insecure location without proper access controls in place.

CWE-219Aug 22, 2024
CVSS8.7v4.0EPSS0.391%PoCs0SignalsSTIX

Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability

Triangle MicroWorks SCADA Data Gateway certificate Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Triangle MicroWorks SCADA Data Gateway. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of certificate web directory. The issue results from the exposure of sensitive information in the application webroot. An attacker can leverage this vul…

CWE-219May 3, 2024
CVSS5.3v3.0EPSS0.58%PoCs0SignalsSTIX

An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and the web server configuration file. These vulnerabilities were found in AirVelocity 1500 running software version 9.3.0.01249, were still present in 15.18.00.2511, and may affect other AirVelocity and AirSpeed models.

CWE-219CWE-548CWE-552Aug 16, 2022
CVSS6.5v3.1EPSS0.952%PoCs0SignalsSTIX

An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability.

CWE-200CWE-219CWE-552Jan 28, 2022
CVSS7.5v3.1EPSS1.81%PoCs0SignalsSTIX

Horde IMP 2.2.7 allows remote attackers to obtain the full web root pathname via an HTTP request for (1) poppassd.php3, (2) login.php3?reason=chpass2, (3) spelling.php3, and (4) ldap.search.php3?ldap_serv=nonsense which leaks the information in error messages.

CWE-219Jul 14, 2005
CVSS5.3v3.1EPSS1.92%PoCs0SignalsSTIX