CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting

Kirby: System path exposure from error messages in the REST API

Inngest TypeScript SDK exposes environment variables via serve() handler on unhandled HTTP methods

Duplicate Advisory: OpenClaw: Gateway hello snapshots exposed host config and state paths to non-admin clients

Duplicate Advisory: OpenClaw Has a Gateway Control Interface Information Disclosure Vulnerability

n8n has Arbitrary File Read via Python Code Node Sandbox Escape

Zitadel Discloses the Total Number of Instance Users

Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order

Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components

Next Server Actions Source Code Exposure

Source Code Exposure Vulnerability in React Server Components

AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

`ed25519-dalek` Double Public Key Signing Function Oracle Attack

Duplicate Advisory: `ed25519-dalek` Double Public Key Signing Function Oracle Attack

Parse Server exposes the data schema via GraphQL API

Umbraco CMS disclosure of configured password requirements

langchain-core allows unauthorized users to read arbitrary files from the host file system

sudo-rs Allows Low Privilege Users to Enumerate Privileges of Others

sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders

Mattermost doesn't restrict domains LLM can request to contact upstream

Drupal Full Path Disclosure

ses's global contour bindings leak into Compartment lexical scope

Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries

Synapse Matrix has a partial room state leak via Sliding Sync