WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-200✕
Overview 12,086 matches · 918 in Waratek scope · 26 protected · 120 exploited · 19 CISA KEV · 697 public PoC · 98 EPSS ≥ 0.5
12,086matches 918in Waratek scope7.6% 26protected0.2% 120exploited1.0% 19CISA KEV0.2% 697public PoC5.8% 98EPSS ≥ 0.50.8%
Protected by Waratek 26 0.2% Rule in development 0 0.0% Mitigation candidate 30 0.2% No exploit published 862 7.1% Outside Waratek scope 124 1.0% Not applicable 11,043 91.4% Withdrawn CVE 1 0.0%
Critical 424 3.5% High 2,743 22.7% Medium 7,722 63.9% Low 1,191 9.9% None 2 0.0% Unknown 4 0.0%
blocked by ARMR today 26 0.2% partly blocked 0 0.0% not blocked 12,060 99.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 120 1.0% Working exploit published 590 4.9% Proof of concept only 932 7.7% Forecast only 14 0.1% No public exploit 10,430 86.3%
split by peak 2,535 / year
Withdrawn CVE: 1Not applicable: 11,043Outside Waratek scope: 124No exploit published: 862Mitigation candidate: 30Protected by Waratek: 26 Unknown: 4None: 2Low: 1,191Medium: 7,722High: 2,743Critical: 424 not blocked: 12,060blocked by ARMR today: 26 No public exploit: 10,430Forecast only: 14Proof of concept only: 932Working exploit published: 590Exploited: 120
19974 Not applicable4 Critical1 High1 Medium2 not blocked4 No public exploit4 19981 Not applicable1 Medium1 not blocked1 No public exploit1 19999 Not applicable9 High1 Medium7 Low1 not blocked9 Working exploit published2 No public exploit7 20005 Mitigation candidate1 Not applicable4 Medium3 Low2 not blocked5 Working exploit published4 No public exploit1 20013 Mitigation candidate1 No exploit published1 Not applicable1 Medium2 Low1 not blocked3 Working exploit published1 No public exploit2 200218 Mitigation candidate1 Not applicable17 High1 Medium15 Low2 not blocked18 Exploited1 Working exploit published5 Forecast only1 No public exploit11 200326 No exploit published1 Not applicable25 High3 Medium22 Low1 not blocked26 Working exploit published14 No public exploit12 20045 Protected by Waratek1 Not applicable4 Medium5 blocked by ARMR today1 not blocked4 Working exploit published2 No public exploit3 200520 Mitigation candidate2 No exploit published4 Not applicable14 High3 Medium14 Low3 not blocked20 Working exploit published3 No public exploit17 200633 Mitigation candidate1 No exploit published4 Not applicable28 High1 Medium26 Low6 not blocked33 Working exploit published10 No public exploit23 2007101 Mitigation candidate2 No exploit published2 Outside Waratek scope3 Not applicable94 High13 Medium75 Low13 not blocked101 Working exploit published22 No public exploit79 2008191 Mitigation candidate1 No exploit published8 Outside Waratek scope3 Not applicable179 High25 Medium128 Low38 not blocked191 Exploited1 Working exploit published32 No public exploit158 2009160 Mitigation candidate1 No exploit published17 Outside Waratek scope1 Not applicable141 High28 Medium107 Low25 not blocked160 Exploited1 Working exploit published36 No public exploit123 2010158 Mitigation candidate1 No exploit published5 Not applicable152 High4 Medium122 Low32 not blocked158 Working exploit published18 No public exploit140 2011293 No exploit published8 Outside Waratek scope1 Not applicable284 High4 Medium258 Low31 not blocked293 Working exploit published10 No public exploit283 2012222 Protected by Waratek2 No exploit published3 Outside Waratek scope1 Not applicable216 High1 Medium186 Low35 blocked by ARMR today2 not blocked220 Working exploit published18 No public exploit204 2013246 Mitigation candidate1 No exploit published6 Outside Waratek scope7 Not applicable232 Critical1 High11 Medium176 Low58 not blocked246 Exploited1 Working exploit published8 Forecast only1 No public exploit236 2014356 Protected by Waratek6 No exploit published15 Outside Waratek scope10 Not applicable325 High22 Medium263 Low71 blocked by ARMR today6 not blocked350 Exploited3 Working exploit published25 Proof of concept only1 No public exploit327 2015596 No exploit published13 Outside Waratek scope13 Not applicable570 Critical2 High22 Medium434 Low138 not blocked596 Exploited2 Working exploit published28 Proof of concept only1 Forecast only1 No public exploit564 2016684 Protected by Waratek1 Mitigation candidate4 No exploit published36 Outside Waratek scope12 Not applicable631 Critical13 High130 Medium459 Low82 blocked by ARMR today1 not blocked683 Exploited2 Working exploit published30 Proof of concept only5 Forecast only3 No public exploit644 20171,315 Mitigation candidate1 No exploit published75 Outside Waratek scope16 Not applicable1,223 Critical47 High284 Medium886 Low98 not blocked1,315 Exploited8 Working exploit published132 Proof of concept only6 Forecast only1 No public exploit1,168 20181,079 Mitigation candidate3 No exploit published72 Outside Waratek scope14 Not applicable990 Critical57 High357 Medium618 Low47 not blocked1,079 Exploited9 Working exploit published51 Proof of concept only7 Forecast only2 No public exploit1,010 2019563 Protected by Waratek2 Mitigation candidate1 No exploit published18 Outside Waratek scope7 Not applicable535 Critical19 High144 Medium371 Low29 blocked by ARMR today2 not blocked561 Exploited5 Working exploit published14 Proof of concept only4 Forecast only2 No public exploit538 2020366 Protected by Waratek1 Mitigation candidate2 No exploit published19 Outside Waratek scope9 Not applicable335 Critical15 High109 Medium220 Low22 blocked by ARMR today1 not blocked365 Exploited3 Working exploit published17 Proof of concept only3 Forecast only1 No public exploit342 2021317 Protected by Waratek4 Mitigation candidate2 No exploit published21 Outside Waratek scope9 Not applicable281 Critical17 High84 Medium194 Low22 blocked by ARMR today4 not blocked313 Exploited12 Working exploit published9 Proof of concept only3 No public exploit293 2022497 Protected by Waratek1 Mitigation candidate1 No exploit published21 Outside Waratek scope4 Not applicable470 Critical14 High141 Medium303 Low39 blocked by ARMR today1 not blocked496 Exploited5 Working exploit published9 Proof of concept only42 No public exploit441 2023605 Protected by Waratek1 Mitigation candidate2 No exploit published29 Outside Waratek scope5 Not applicable568 Critical23 High237 Medium327 Low18 blocked by ARMR today1 not blocked604 Exploited13 Working exploit published14 Proof of concept only77 No public exploit501 2024845 Protected by Waratek2 Mitigation candidate2 No exploit published35 Outside Waratek scope3 Not applicable802 Withdrawn CVE1 Critical37 High256 Medium515 Low35 Unknown2 blocked by ARMR today2 not blocked843 Exploited21 Working exploit published23 Proof of concept only105 Forecast only2 No public exploit694 2025833 Protected by Waratek3 No exploit published22 Outside Waratek scope4 Not applicable804 Critical64 High210 Medium491 Low68 blocked by ARMR today3 not blocked830 Exploited20 Working exploit published21 Proof of concept only188 No public exploit604 20262,535 Protected by Waratek2 No exploit published427 Outside Waratek scope2 Not applicable2,104 Critical114 High651 Medium1,492 Low274 None2 Unknown2 blocked by ARMR today2 not blocked2,533 Exploited13 Working exploit published32 Proof of concept only490 No public exploit2,000
1999200220052008201120142017202020232026
12,086 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 121 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-92086 Medium 2026-10-29 Not applicable No public exploit The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'post_id' parameter. This makes it possible for unauthenticated attackers to extract personally identifiable information from other users' form inquiry records, including submitted names, email addresses, and free-text message bodies, by enumerating sequential post IDs. Exploitation requires the targeted form to have the querystring setting enabled, but this is a standard documented feature of the plugin.
CVE-2026-91153 Medium 2026-10-29 Not applicable No public exploit The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the process. This makes it possible for unauthenticated attackers to extract arbitrary WordPress post meta values — including license keys, API tokens, SMTP credentials, and Stripe or AWS secrets stored on any post type — via form submission notification emails or stored entries. The submission nonce is publicly rendered in every embedded form and can additionally be minted anonymously via the nopriv everest_forms_get_form_update_nonce action, meaning no account or prior authentication of any kind is required to complete the exploit.
CVE-2026-78396 Medium 2026-10-29 Not applicable No public exploit The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to display.
CVE-2026-77817 Medium 2026-10-29 Not applicable No public exploit IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.
CVE-2026-40063 Medium 2026-10-29 Not applicable No public exploit A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an information leak. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
CVE-2026-119199 Medium 2026-10-29 Not applicable No public exploit Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at build time into that bundle, including secrets configured in nuxt.config, and Nuxt 4.6.0 and later also inline the generated development appSecret. The default localhost binding limits remote exposure, production builds and Nitro 3 are not affected, and runtime configuration supplied only through NUXT_* environment variables at server startup is not inlined. This issue is fixed in version 4.6.3.
CVE-2026-119125 Low 2026-10-29 Not applicable No public exploit Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object update responses, even to clients without read access to that object or field. An authenticated client able to update an object whose beforeSave trigger reverts a field, via revert() or a constant: true validator, can read protected values, including its own account's raw MFA authData when protectedFieldsTriggerExempt is enabled.
CVE-2026-118759 High 2026-10-29 Not applicable No public exploit Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the caller against the selected run. A caller who can reach the backend and knows a victim run ID and suitable pod or node identifier can read live or archived logs with the API server's permissions. For live logs, the caller-controlled node ID was also accepted as a pod name without verifying that the pod belonged to the requested run, allowing a known run ID to select the namespace of an unrelated pod and read its main container logs. The handler does not authenticate requests itself, although an external authentication gate or network policy can limit reachability. Exposed logs can contain sensitive workload data or credentials. This issue is fixed in version 2.18.0.
CVE-2026-117688 Medium 2026-10-29 No exploit published No public exploit A flaw was found in the client registration component of Keycloak, an open-source identity and access management solution. When a vault provider is used to store sensitive information, an authenticated client owner can use a specially crafted reference to trick the system into revealing secrets. By updating a client secret to point to a vault entry and then requesting the client configuration, the owner can see the secret value in plain text. This could lead to the exposure of sensitive credentials that the user should not be able to access.
CVE-2026-115282 Medium 2026-10-29 Not applicable No public exploit The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and password-protected posts, that contain a recipe card block. Its optional "print only published posts" protection does not prevent this, because the status check is applied to a different post than the one ultimately rendered.
CVE-2026-114270 Medium 2026-10-29 Not applicable No public exploit The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing, allowing unauthenticated users to disclose the content and custom fields of published listings that are protected by a post password.
CVE-2026-113693 Medium 2026-10-29 Not applicable No public exploit Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.
CVE-2026-108686 Low 2026-10-29 Not applicable No public exploit The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.
CVE-2026-63190 Critical 2026-10-28 Not applicable Proof of concept only FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or adequate `path` validation. On PHP's built-in development server, including the default Docker deployment, `router.php` checks an unnormalized admin URI prefix while the filesystem resolves dot segments, so `/./admin/` bypasses the admin login gate and executes those scripts directly. In `admin/debug_save_flow.php`, attacker-controlled `path` and `content` reach `file_put_contents` for arbitrary `.md` writes under `content`/ or outside it through `path` traversal, enabling site defacement and stored JavaScript in public pages; `print_r($_POST)` output without `htmlspecialchars` escaping also causes reflected cross-site scripting. The `admin/debug_content.php` `path` parameter reaches `scandir()`, `file_get_contents()` and `posix_getpwuid()`, permitting arbitrary directory enumeration and `.md` file reads that expose absolute paths, ownership, permissions, hashes and `content` previews. The `admin/preview-handler.php` endpoint accepts JSON `content` and `title` and writes enumerable files under `content/_preview/`, enabling stored cross-site scripting and disk exhaustion. The `admin/testdebug.php` endpoint appends to `admin/testdebug.log` without authentication, also enabling disk exhaustion. The `admin/test_redirect.php` script exposes a test artifact but escapes its inputs and is not itself an XSS sink. Stored script execution can steal sessions and compromise administrators when they view affected `content`. Reads and writes execute with PHP's privileges; the tested deployment runs PHP as root, amplifying filesystem impact. This issue is fixed in version 0.1.4.
CVE-2026-118666 Medium 2026-10-28 Not applicable Proof of concept only GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessage handler whenever a new overlapping subscription starts. The handler delivers LEGACY_WS.DATA frames to the newest observer without comparing data.id with the subscription operation id, so a caller using the same executor can receive another user's authorized subscription payload while the earlier caller's stream is starved. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.
CVE-2026-118578 Low 2026-10-28 Not applicable Proof of concept only A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipulation results in information disclosure. The attack can only be performed from the local network. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-118272 Low 2026-10-28 Not applicable Proof of concept only A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error message. It is possible to initiate the attack remotely. The exploit is now public and may be used. The patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01. It is suggested to install a patch to address this issue.
CVE-2026-116593 High 2026-10-28 No exploit published No public exploit Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration and only resolve them at runtime.  An attacker with access to the validate endpoint can use it to resolve and return plaintext values via any of the configuration providers installed on a Connect worker. Users are recommended to upgrade to version 4.2.2, 4.3.2, 4.4.0 or above, which fix this issue.
CVE-2026-113494 Low 2026-10-28 Not applicable No public exploit The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id attribute in its field shortcodes, allowing users with the Contributor role and above to disclose the content and custom fields of other users' draft, pending, private and trashed listings.
CVE-2026-110509 Medium 2026-10-28 Not applicable No public exploit The Essential Addons for Elementor WordPress plugin before 6.8.7 does not restrict the post type or meta query an unauthenticated visitor can pass to its pagination endpoint, which could allow them to read content of non-public post types and recover the values of private custom fields on published posts.
CVE-2026-110507 Low 2026-10-28 Not applicable No public exploit The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft, pending, scheduled and private posts and pages.
CVE-2026-110292 Medium 2026-10-28 Not applicable No public exploit The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order.
CVE-2026-107100 Medium 2026-10-28 Not applicable No public exploit The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action, relying only on the published status and not on the post type's visibility, allowing unauthenticated users to disclose the content of posts stored in non-public post types, for example captured contact-form submissions containing names, email addresses and messages.
CVE-2026-105617 Medium 2026-10-28 Not applicable No public exploit PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed. Users using such plans can still see the unmasked data until the end of the session. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
CVE-2026-105616 Medium 2026-10-28 Not applicable No public exploit PostgreSQL restricts acces to the salt and shift via the `SHOW` command for users not member of `pg_read_all_settings`. But they are visible in `pg_db_role_setting` or `pg_roles` if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE for the salt. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
CVE-2026-103372 Medium 2026-10-28 Not applicable No public exploit The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link, allowing unauthenticated users to obtain any paid order's key and, for recent guest orders, view the customer's personal details.
CVE-2026-82983 Low 2026-10-27 Not applicable No public exploit The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients (users, groups, and teams) along with their permission levels. A user who was only granted read-data access to a table, and who is correctly prevented from seeing this information in the web UI, could call the endpoint directly to enumerate everyone the table is shared with and their access levels. This does not expose the table's data itself beyond what the read-data grant already permits, only the list of share recipients and their permission levels.
CVE-2026-118176 High 2026-10-27 Not applicable No public exploit Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
CVE-2026-118175 High 2026-10-27 Not applicable No public exploit When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
CVE-2026-118003 High 2026-10-27 Not applicable No public exploit Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-118002 High 2026-10-27 Not applicable No public exploit Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-118000 High 2026-10-27 Not applicable No public exploit Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117992 Medium 2026-10-27 Not applicable No public exploit Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.
CVE-2026-117604 High 2026-10-27 Not applicable No public exploit Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
CVE-2026-116819 High 2026-10-27 Not applicable No public exploit OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.
CVE-2026-116805 Medium 2026-10-27 Not applicable No public exploit OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and receive full Client rows including the secret column, enabling offline verification of leaked secrets without audit trails.
CVE-2026-116691 Medium 2026-10-27 Not applicable Proof of concept only MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts the Agent llm field to a string that includes the provider API key, while mlflow/crewai/autolog.py::_construct_full_inputs() expands the Agent object into mlflow.spanInputs. Applications can therefore send plaintext provider credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. This issue is fixed in version 3.17.0.
CVE-2026-116685 Medium 2026-10-27 Not applicable No public exploit The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client client paths enable follow_redirects and follow redirects to a different origin, forwarding caller-supplied custom credential headers and, for 307 or 308 responses, the request body. An attacker who can influence a trusted endpoint's redirect destination can receive that material. This issue is fixed in versions 1.30.0 and 2.2.0.
CVE-2026-107067 Medium 2026-10-27 Not applicable No public exploit An issue in Shirt Pocket's SuperDuper! 4.0.9 and earlier allow a local attacker to obtain sensitive information
CVE-2026-86978 Low 2026-10-26 Not applicable No public exploit This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, tvOS 27.2. An app may be able to access sensitive user data.
CVE-2026-86931 Medium 2026-10-26 Not applicable No public exploit A privacy issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data.
CVE-2026-86923 Low 2026-10-26 Not applicable No public exploit An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data.
CVE-2026-84498 Medium 2026-10-26 Not applicable No public exploit The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to disclose kernel memory.
CVE-2026-82943 Medium 2026-10-26 Not applicable No public exploit SOEM version 2.0.0 and earlier contains vulnerabilities where a malicious device can send messages that cause the master to read data from memory locations beyond the intended buffer. The software uses length values from device responses without validating them against actual buffer sizes. An attacker can exploit this to extract up to 64KB of data from the master's memory.
CVE-2026-116575 Medium 2026-10-26 Not applicable No public exploit Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.
CVE-2026-116507 Medium 2026-10-26 Not applicable Proof of concept only A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used.
CVE-2026-116479 Medium 2026-10-26 Not applicable No public exploit A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. Patch name: bbee3369f3825d0fba2373d821f6dc6d4fc82ec0. Upgrading the affected component is advised.
CVE-2026-116478 Medium 2026-10-26 Not applicable No public exploit A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.
CVE-2026-116477 Medium 2026-10-26 Not applicable No public exploit A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. Upgrading to version 1.0.0-preview3 is sufficient to resolve this issue. The identifier of the patch is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. Upgrading the affected component is recommended.
CVE-2026-116284 Medium 2026-10-26 Not applicable Proof of concept only A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116283 Medium 2026-10-26 Not applicable No public exploit A weakness has been identified in Kameleo up to 5.0.1.26. This affects an unknown part of the file /profiles of the component Local API. This manipulation causes information disclosure. The attack is possible to be carried out remotely. Upgrading to version 5.2.0 is able to mitigate this issue. Upgrading the affected component is advised.
CVE-2026-116282 Medium 2026-10-26 Not applicable No public exploit A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-116281 Medium 2026-10-26 Not applicable Proof of concept only A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses this issue. Upgrading the affected component is recommended.
CVE-2026-116122 Medium 2026-10-26 Not applicable No public exploit A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is considered difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.
CVE-2026-113908 Medium 2026-10-26 Not applicable No public exploit A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112707 Low 2026-10-26 Not applicable No public exploit A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2. An app may be able to identify what other apps a user has installed.
CVE-2026-112704 Medium 2026-10-26 Not applicable No public exploit An information leakage was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. A malicious app may be able to break out of its sandbox.
CVE-2026-112665 Low 2026-10-26 Not applicable No public exploit An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, watchOS 27.2. An app may be able to determine kernel memory layout.
CVE-2026-112628 Medium 2026-10-26 Not applicable No public exploit This issue was addressed with improved data access restriction. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. An app may be able to access sensitive user data.
CVE-2026-112617 Medium 2026-10-26 Not applicable No public exploit An information disclosure issue was addressed with improved logic. This issue is fixed in macOS Golden Gate 27.2. An app may be able to access sensitive user data.
CVE-2026-112577 Medium 2026-10-26 Not applicable No public exploit A privacy issue was addressed by moving sensitive data. This issue is fixed in macOS Golden Gate 27.2. An app may be able to access sensitive user data.
CVE-2026-112575 Medium 2026-10-26 Not applicable No public exploit The issue was addressed with improved handling of secure input state. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to monitor keystrokes without user permission.
CVE-2026-112537 Medium 2026-10-26 Not applicable No public exploit This issue was addressed with improved data protection. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to read sensitive location information.
CVE-2026-112500 Medium 2026-10-26 Not applicable No public exploit A logic issue was addressed with improved restrictions. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. The user's original email address may be leaked when using the Hide My Email feature.
CVE-2026-112441 Low 2026-10-26 Not applicable No public exploit This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data.
CVE-2026-104596 High 2026-10-26 Not applicable No public exploit libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.
CVE-2013-10077 Medium 2026-10-26 Not applicable No public exploit A weakness has been identified in OctoPrint 1.0.0. This impacts the function getSettings of the file src/octoprint/server/ajax/settings.py of the component API Key Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.1.0-rc1 will fix this issue. Patch name: eccc9d6fbde0c46cdd6e255fd5ce9a30077ba954. You should upgrade the affected component. Affected is a 2013 release where access control was not yet implemented and the endpoint was part of first-run setup). The API key has been admin-gated since 1.2.0 and GET /api/settings is protected by Permissions.SETTINGS_READ plus reauthentication in all current releases.
CVE-2026-116193 Medium 2026-10-25 Not applicable Proof of concept only Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can probe arbitrary paths and compare Allow header values to determine whether files or collections exist, enabling namespace enumeration.
CVE-2026-116190 Medium 2026-10-25 Not applicable Proof of concept only rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.
CVE-2026-116161 Medium 2026-10-25 Not applicable No public exploit Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription hash omits constraints next to a $or operator, including the _Session owner filter and beforeSubscribe constraints, so distinct subscriptions are grouped together. Authenticated clients subscribing with $or queries can receive other users' events, including session tokens usable for impersonation.
CVE-2026-111976 Medium 2026-10-25 Not applicable No public exploit The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.
CVE-2026-113492 Medium 2026-10-24 Not applicable No public exploit The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.
CVE-2026-113490 Medium 2026-10-24 Not applicable No public exploit The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.
CVE-2026-57146 High 2026-10-23 Not applicable Proof of concept only PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes the same A2U subscription and event routes without authentication when the operator starts the documented CLI entrypoint. The current CLI wrapper does not expose --api-key, does not install the common API-key middleware, and does not generate a token for A2U. It calls create_a2u_routes(app) directly. That helper only enforces auth if A2U_AUTH_TOKEN is already present; if the variable is missing, _authenticate_request() returns None and treats auth as disabled. This issue has been patched in version 4.6.61.
CVE-2026-57116 Critical 2026-10-23 Not applicable Proof of concept only PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm96-6xpr-978x / CVE-2026-40151. The chat route directly calls agent.chat(request.message). No-auth and wrong-bearer requests both execute the deployed agent. This is broader than passive metadata disclosure. In any deployment where AgentOS wraps agents with tools, private context, memory, API integrations, or cost-bearing model calls, an unauthenticated reachable client can drive those agents. This issue has been patched in version 4.6.59.
CVE-2026-56834 High 2026-10-23 Not applicable Proof of concept only PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools(). The implemented artifact tools do not enforce that the supplied artifact_path is an artifact created by the configured store or that it lives under the configured artifact base directory. Instead, artifact_head, artifact_tail, artifact_grep, and artifact_chunk wrap the caller-supplied path directly into an ArtifactRef and then read it from the host filesystem. As a result, any prompt/user/tool-caller that can influence those tool arguments can read files readable by the PraisonAI process, such as project .env files, cloud credentials, SSH keys, source files, or other local data. This issue has been patched in version 4.6.59.
CVE-2026-56833 High 2026-10-23 Not applicable No public exploit PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. Those tools accept run_id and agent_id arguments from the tool caller. The underlying stores join those values into filesystem paths without rejecting absolute paths or .. traversal. Because run_id can be an absolute path and agent_id can contain traversal, a lower-trust prompt/user that can call these tools can read .jsonl and .log files outside the configured Dynamic Context base directory. This issue has been patched in version 4.6.59.
CVE-2026-55826 High 2026-10-23 Not applicable No public exploit The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websites. From version 2.0.0 to before version 2.1.48, the WooCommerce purchase event tracking mechanism allows an unauthenticated attacker to trigger the rendering of another customer's full order data — including personally identifiable information (PII) — into the page's JavaScript dataLayer. This issue has been patched in version 2.1.48.
CVE-2026-53920 High 2026-10-23 Not applicable No public exploit odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3.
CVE-2026-114623 Medium 2026-10-23 Not applicable No public exploit baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-file view permission can traverse outside the theme directory through the optional BcThemeFile plugin's Admin web screen. ThemeFilesController::parseArgs() constructs a path containing literal ../ segments, and the view and edit actions pass it to ThemeFilesService::get() without containment validation. Authorization checks the unresolved request path, after which ThemeFile::_getContents() reads the resolved file and exposes its contents in the form textarea. A client must preserve the dot segments rather than normalize them away. Readable files are limited to .php, .css, .js, and .ctp; this can disclose application source and config/install.php database credentials in MySQL or PostgreSQL deployments, while SQLite configurations have an empty database password. Reading config/app_local.php may expose the Security.salt fallback, which is effective only when not overridden by environment configuration. The flaw does not disclose .env, .pem, or SQLite .db files, does not itself permit file writes or code execution, and does not affect the separate API getFullpath() route. The plugin is disabled by default and unauthenticated requests are not sufficient. This issue has been patched in versions 5.3.2 and 5.4.2.
CVE-2026-109935 Medium 2026-10-23 Not applicable No public exploit The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific roles, logged-in users, the post author, categories or tags, or (on the Pro tier) Stripe purchasers.
CVE-2026-109934 Medium 2026-10-23 Not applicable No public exploit The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data through a REST API endpoint, treating any post with the published status as public, allowing unauthenticated users to read manual excerpts of password-protected posts, the content and titles of non-public post types, and, on WooCommerce sites, coupon codes and their descriptions.
CVE-2026-95712 High 2026-10-22 Not applicable No public exploit A sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service. Successful exploitation could allow an attacker to view some information and to disrupt the availability of the affected service.
CVE-2026-79876 Critical 2026-10-22 Not applicable No public exploit A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service.
CVE-2026-79871 Critical 2026-10-22 Not applicable No public exploit A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.
CVE-2026-79853 Critical 2026-10-22 Not applicable No public exploit Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
CVE-2026-115449 Low 2026-10-22 Not applicable No public exploit A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.
CVE-2026-114657 Medium 2026-10-22 Not applicable No public exploit Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic credentials through Twig page content. Authors can print the request Uri object, which embeds PHP_AUTH_USER and PHP_AUTH_PW, inside an inline style background image to exfiltrate administrators' credentials to an external host.
CVE-2026-114606 Medium 2026-10-22 Not applicable Proof of concept only draw.io Desktop is the official Electron build of draw.io. Prior to 31.4.4, draw.io Desktop is vulnerable to arbitrary local-file disclosure through the Electron main process's read-side IPC handlers. The readFile, getFileDrafts, getBkpFile, fileStat, isFileWritable, checkFileExists, and watchFile actions operate on a renderer-chosen filesystem path with no blessed-path (assertWritablePath) authorization. The only gates are validateSender — a URL-prefix origin check — plus, for readFile alone, a content "sniff" and a lexical appBaseDir prefix block. The write-side handlers (saveFile, writeFile, saveDraft, deleteFile) are all protected by assertWritablePath; the read side is not. The result is a read/write authorization asymmetry: any frame executing in the app's file:// origin can read the contents of local files that the same origin is explicitly forbidden to write. This issue is fixed in version 31.4.4.
CVE-2026-114574 Low 2026-10-22 Not applicable Proof of concept only A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is d25d8fa3f5a1e34285c8634f18729650c0c05cda. It is advisable to implement a patch to correct this issue.
CVE-2026-92999 Medium 2026-10-21 Not applicable No public exploit The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record (names, email addresses and phone numbers).
CVE-2026-76307 High 2026-10-21 Not applicable No public exploit In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the inferred token grants administrative access, that user could gain administrative access to the Splunk SOAR instance. The vulnerability is possible because the REST API accepts caller-controlled query filters on sensitive user record fields. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/6.4.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
CVE-2026-76306 High 2026-10-21 Not applicable No public exploit In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users. The information disclosure is possible because Splunk SOAR applies REST API query filters to user records before it protects sensitive fields from query processing. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.5.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Query for Data (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/7.1.0/using-the-splunk-soar-rest-api/query-for-data), and Manage roles and permissions in Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.5.0/manage-your-splunk-soar-on-premises-users-and-accounts/manage-roles-and-permissions-in-splunk-soar-on-premises) in the Splunk documentation.
CVE-2026-113706 Medium 2026-10-21 Not applicable No public exploit A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.
CVE-2026-111956 Medium 2026-10-21 Not applicable No public exploit The WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a predictable name, allowing unauthenticated users to download the most recently imported user data, including any account passwords and customer contact and address details it contains.
CVE-2026-108073 Medium 2026-10-21 Not applicable No public exploit The SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell funnel through its REST API, nor strip private fields from those objects, allowing unauthenticated users to read merchant-private catalog data such as pricing, commission, stock, SKU and tax internals, including unpublished products.
CVE-2026-105999 Medium 2026-10-21 Not applicable No public exploit The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a response, allowing unauthenticated users to disclose sensitive settings including the administrator's notification email addresses.
CVE-2026-96903 Medium 2026-10-20 Not applicable No public exploit The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.
CVE-2026-96902 Medium 2026-10-20 Not applicable No public exploit The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.
CVE-2026-94265 Critical 2026-10-20 Not applicable Proof of concept only When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously retain and re-transmit the original host's HTTP Negotiate authentication state. Consequently, a malicious server can trigger a redirect containing arbitrary userinfo to force curl to send a freshly minted Kerberos ticket—generated using the ambient identity of the client process to an untrusted third-party host, effectively bypassing the domain-scoping restrictions normally enforced by the absence of `--location-trusted`.
‹ prev page 3 of 121 next ›