CVE-2026-115400Medium· 4.4▾ Sunlitcrawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can r…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 24.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users' Google Search Console data.
crawlseo >= 0.1.0 < 0.2.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115411Medium· 5.0crawlseo before 0.2.4 Server-Side Request Forgery via Crawler
CVE-2026-34214High· 7.7Trino is a distributed SQL query engine for big data analytics
CVE-2026-7163Medium· 6.1A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated user with minimal namespace-scoped privileges to obtain administrativ…
CVE-2026-96293Medium· 6.9Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File
CVE-2026-114223Medium· 5.5NewType Infortech｜NT OneAPP - Exposure of Sensitive Information
CVE-2025-7203Medium· 4.9Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials