WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-200✕
Overview 7,722 matches · 541 in Waratek scope · 16 protected · 51 exploited · 6 CISA KEV · 461 public PoC · 46 EPSS ≥ 0.5
7,722matches 541in Waratek scope7.0% 16protected0.2% 51exploited0.7% 6CISA KEV0.1% 461public PoC6.0% 46EPSS ≥ 0.50.6%
Protected by Waratek 16 0.2% Rule in development 0 0.0% Mitigation candidate 19 0.2% No exploit published 506 6.6% Outside Waratek scope 90 1.2% Not applicable 7,091 91.8% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 7,722 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 16 0.2% partly blocked 0 0.0% not blocked 7,706 99.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 51 0.7% Working exploit published 413 5.3% Proof of concept only 454 5.9% Forecast only 8 0.1% No public exploit 6,796 88.0%
split by peak 1,492 / year
Not applicable: 7,091Outside Waratek scope: 90No exploit published: 506Mitigation candidate: 19Protected by Waratek: 16 Medium: 7,722 not blocked: 7,706blocked by ARMR today: 16 No public exploit: 6,796Forecast only: 8Proof of concept only: 454Working exploit published: 413Exploited: 51
19972 Not applicable2 Medium2 not blocked2 No public exploit2 19981 Not applicable1 Medium1 not blocked1 No public exploit1 19997 Not applicable7 Medium7 not blocked7 Working exploit published1 No public exploit6 20003 Mitigation candidate1 Not applicable2 Medium3 not blocked3 Working exploit published2 No public exploit1 20012 Mitigation candidate1 No exploit published1 Medium2 not blocked2 Working exploit published1 No public exploit1 200215 Mitigation candidate1 Not applicable14 Medium15 not blocked15 Exploited1 Working exploit published5 No public exploit9 200322 Not applicable22 Medium22 not blocked22 Working exploit published13 No public exploit9 20045 Protected by Waratek1 Not applicable4 Medium5 blocked by ARMR today1 not blocked4 Working exploit published2 No public exploit3 200514 Mitigation candidate2 No exploit published2 Not applicable10 Medium14 not blocked14 Working exploit published3 No public exploit11 200626 Mitigation candidate1 No exploit published3 Not applicable22 Medium26 not blocked26 Working exploit published9 No public exploit17 200775 Mitigation candidate2 No exploit published2 Outside Waratek scope2 Not applicable69 Medium75 not blocked75 Working exploit published20 No public exploit55 2008128 Mitigation candidate1 No exploit published6 Outside Waratek scope3 Not applicable118 Medium128 not blocked128 Working exploit published28 No public exploit100 2009107 Mitigation candidate1 No exploit published5 Not applicable101 Medium107 not blocked107 Exploited1 Working exploit published30 No public exploit76 2010122 No exploit published5 Not applicable117 Medium122 not blocked122 Working exploit published12 No public exploit110 2011258 No exploit published4 Not applicable254 Medium258 not blocked258 Working exploit published9 No public exploit249 2012186 Protected by Waratek2 No exploit published2 Not applicable182 Medium186 blocked by ARMR today2 not blocked184 Working exploit published16 No public exploit170 2013176 Mitigation candidate1 No exploit published4 Outside Waratek scope6 Not applicable165 Medium176 not blocked176 Exploited1 Working exploit published4 Forecast only1 No public exploit170 2014263 Protected by Waratek5 No exploit published12 Outside Waratek scope10 Not applicable236 Medium263 blocked by ARMR today5 not blocked258 Exploited1 Working exploit published17 Proof of concept only1 No public exploit244 2015434 No exploit published12 Outside Waratek scope12 Not applicable410 Medium434 not blocked434 Working exploit published18 Proof of concept only1 Forecast only1 No public exploit414 2016459 No exploit published26 Outside Waratek scope4 Not applicable429 Medium459 not blocked459 Exploited1 Working exploit published21 Proof of concept only3 Forecast only1 No public exploit433 2017886 No exploit published44 Outside Waratek scope9 Not applicable833 Medium886 not blocked886 Exploited4 Working exploit published103 Proof of concept only5 No public exploit774 2018618 Mitigation candidate1 No exploit published52 Outside Waratek scope10 Not applicable555 Medium618 not blocked618 Exploited2 Working exploit published25 Proof of concept only6 Forecast only1 No public exploit584 2019371 Protected by Waratek2 Mitigation candidate1 No exploit published11 Outside Waratek scope4 Not applicable353 Medium371 blocked by ARMR today2 not blocked369 Exploited3 Working exploit published9 Proof of concept only1 Forecast only2 No public exploit356 2020220 Protected by Waratek1 Mitigation candidate2 No exploit published8 Outside Waratek scope8 Not applicable201 Medium220 blocked by ARMR today1 not blocked219 Working exploit published10 Proof of concept only1 Forecast only1 No public exploit208 2021194 Protected by Waratek2 Mitigation candidate2 No exploit published16 Outside Waratek scope8 Not applicable166 Medium194 blocked by ARMR today2 not blocked192 Exploited6 Working exploit published7 Proof of concept only2 No public exploit179 2022303 Protected by Waratek1 No exploit published11 Outside Waratek scope3 Not applicable288 Medium303 blocked by ARMR today1 not blocked302 Exploited2 Working exploit published5 Proof of concept only26 No public exploit270 2023327 Protected by Waratek1 Mitigation candidate1 No exploit published20 Outside Waratek scope5 Not applicable300 Medium327 blocked by ARMR today1 not blocked326 Exploited6 Working exploit published5 Proof of concept only33 No public exploit283 2024515 Mitigation candidate1 No exploit published15 Outside Waratek scope3 Not applicable496 Medium515 not blocked515 Exploited9 Working exploit published12 Proof of concept only63 Forecast only1 No public exploit430 2025491 No exploit published10 Outside Waratek scope3 Not applicable478 Medium491 not blocked491 Exploited9 Working exploit published10 Proof of concept only80 No public exploit392 20261,492 Protected by Waratek1 No exploit published235 Not applicable1,256 Medium1,492 blocked by ARMR today1 not blocked1,491 Exploited5 Working exploit published16 Proof of concept only232 No public exploit1,239
1999200220052008201120142017202020232026
7,722 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 78 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-68541 Medium 2026-11-13 Not applicable No public exploit PolicyPress is a compliance policy management tool for small and mid-size teams. Prior to version 1.4.1, sensitive content is disclosed via CSS-only web redaction and insecure starter workflow defaults. This issue has been patched in version 1.4.1.
CVE-2026-128080 Medium 2026-11-13 Not applicable No public exploit OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/instrumentation-http writes the raw query string from incoming HTTP requests to the url.query server-span attribute without applying the redactedQueryParams protection used for outgoing spans. Services receiving signed URLs or other credentials in query parameters can therefore export still-valid secrets to tracing backends, where observability infrastructure and users with span-read access may read them. The redactedQueryParams option does not protect incoming spans in affected versions. This issue is fixed in version 0.222.0.
CVE-2026-128033 Medium 2026-11-13 Not applicable No public exploit OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage_Rss_Model_Resource_Order::getAllCommentCollection(), which omits the is_visible_on_front filter for invoice, shipment and credit-memo comments. Authenticated customers can open the /rss/order/status feed for their order to read internal staff comments, such as fraud-review and payment notes.
CVE-2026-128021 Medium 2026-11-13 Not applicable Proof of concept only FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers sending requests to the same worker thread can call libxml_get_errors() or libxml_get_last_error() to obtain other clients' parsed-document fragments and server filesystem paths.
CVE-2026-128019 Medium 2026-11-13 Not applicable No public exploit FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.
CVE-2026-126939 Medium 2026-11-13 Not applicable No public exploit Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early return and enumerate file names, IDs, MIME types, sizes, and view counts.
CVE-2026-126292 Medium 2026-11-13 Not applicable No public exploit NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking.
CVE-2026-126288 Medium 2026-11-13 Not applicable No public exploit NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve full OAuth client records by querying the public client lookup route in oauth.controller.ts. Attackers who know or guess a client identifier can obtain the registration access token to modify or delete registrations, plus the bcrypt client secret hash and owner's internal identifier.
CVE-2026-124664 Medium 2026-11-13 Not applicable No public exploit The Mine CloudVod WordPress plugin before 2.6.7 does not check whether the requester is enrolled in a course, or authorised at all, before returning the course's full curriculum together with the raw content of every published lesson, allowing unauthenticated visitors to retrieve paid lesson content, such as direct video source URLs, and the passwords of password-protected lessons.
CVE-2026-121853 Medium 2026-11-13 Not applicable No public exploit The AppPresser WordPress plugin before 5.0.0 does not restrict access to two of its REST API endpoints, allowing unauthenticated visitors to retrieve the installed versions of AppPresser, its add-ons, several third-party AppPresser WordPress plugin before 5.0.0 and its .
CVE-2026-121518 Medium 2026-11-13 Not applicable No public exploit The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on wp_ajax_nopriv_* without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into get_comments() as the 'search' argument, which core expands into LIKE conditions over comment_author, comment_author_email, comment_author_url, comment_author_IP and comment_content. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring.
CVE-2026-120407 Medium 2026-11-13 Not applicable No public exploit The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from, allowing users with the Editor role and above to obtain the password hash and sensitive user meta (such as two-factor secrets) of higher-privileged users, including administrators, who view and submit the form.
CVE-2026-107525 Medium 2026-11-13 Not applicable No public exploit Dell PowerStore contains an information disclosure vulnerability. An unauthenticated attacker could exploit this vulnerability to obtain service metadata useful for further attacks.
CVE-2026-126957 Medium 2026-11-12 Not applicable No public exploit An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptr_offset in uint8_t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. net_pkt_write() then reads past the 40-byte opt_data stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIG_NET_IPV4_HDR_OPTIONS, which CONFIG_NET_IPV4_IGMP selects, are affected.
CVE-2026-124653 Medium 2026-11-12 Not applicable No public exploit The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencent Cloud COS and Dogecloud accounts and use them to upload or overwrite files in the site's storage.
CVE-2026-120468 Medium 2026-11-12 Not applicable No public exploit Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with their descriptions, access levels, owning user account and subscriber counts. The WordPress plugin is not affected.
CVE-2026-57500 Medium 2026-11-11 Not applicable No public exploit REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4.
CVE-2026-126920 Medium 2026-11-11 Not applicable No public exploit Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126878 Medium 2026-11-11 Not applicable No public exploit Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-123705 Medium 2026-11-11 Not applicable No public exploit The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve a detailed report of the server, PHP and WordPress configuration, including installed Security For WooCommerce WordPress plugin through 1.0.16 and versions and the site administrator's email address.
CVE-2026-123704 Medium 2026-11-11 Not applicable No public exploit The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site.
CVE-2026-122061 Medium 2026-11-11 Not applicable No public exploit The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays a public attendee list before returning one of its attendees over the REST API, allowing unauthenticated users to retrieve the names of attendees of events that do not show a public attendee list.
CVE-2026-119034 Medium 2026-11-11 Not applicable No public exploit The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, and to retrieve approved comments site-wide.
CVE-2026-118418 Medium 2026-11-11 Not applicable No public exploit The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and private contact-form submissions.
CVE-2026-118409 Medium 2026-11-11 Not applicable No public exploit Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover the email addresses of people who left approved comments. The search index stored commenter email addresses, and the public weblog search accepted queries on that field, including wildcard queries that confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later and rebuild the search index.
CVE-2026-118405 Medium 2026-11-11 Not applicable No public exploit Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other users' email addresses. The user search in the authoring interface shows only user names, but it also matched the search text against email addresses, so a user could confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which matches only user names for users who are not administrators.
CVE-2026-111597 Medium 2026-11-11 Not applicable No public exploit The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying.
CVE-2026-105152 Medium 2026-11-11 Not applicable No public exploit Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rather than the reduced set of fields the wrapper is meant to expose. Roller treats weblog administrators as untrusted and exposes weblog and entry data to templates only through wrapper classes, but a public accessor on those wrapper classes returned the underlying persistent object directly, including the stored password hash of the weblog's creator and of any author whose entry renders on the page. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes template access to the underlying wrapped objects.
CVE-2026-0331 Medium 2026-11-11 Not applicable No public exploit An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated remote attacker with network access to obtain sensitive firewall and session information by sending traffic to or through a dataplane interface. Panorama is not affected by this vulnerability.
CVE-2026-96769 Medium 2026-11-10 Not applicable No public exploit The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the register_company_api. This makes it possible for unauthenticated attackers to extract sensitive company data including owner and member WordPress user IDs, company billing email addresses, credit balances and full credit histories with admin user IDs, per-member purchase limits and spend totals, and shared-cart records containing purchase-order numbers.
CVE-2026-96156 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Windows Broker Infrastructure Service allows an authorized attacker to disclose information locally.
CVE-2026-33563 Medium 2026-11-10 Not applicable No public exploit Exposure of sensitive information to an unauthorized actor for some Intel(R) Platform Monitoring Technology (Intel(R) PMT) software before version 3.2.0.22 within Ring 3: User Applications may allow an information disclosure. System software adversary with an authenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2026-126077 Medium 2026-11-10 Not applicable No public exploit Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret (config.action_dispatch.cookies_rotations) or in the format that a :hybrid cookie serializer migrates from, it writes the cookie back to the response in the current format, and that write ignores request.session_options[:skip]. ActiveStorage::DisableSession relies on that option to keep the session cookie off the public, immutable responses of the Active Storage proxy controllers, but those controllers still load the session, so a request carrying an old-format session cookie could receive the rewritten session cookie in Set-Cookie on a cacheable response. A shared cache that stores such a response together with its Set-Cookie header could then serve one user's session to later requesters of the same URL, or serve an attacker's session to other users. Applications are affected when they serve Active Storage files through the proxy controllers, have a cookie rotation or a :hybrid serializer migration configured, and run behind a cache that stores Set-Cookie on public responses. This is a path around the fix for CVE-2024-26144. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
CVE-2026-124944 Medium 2026-11-10 Not applicable No public exploit Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124941 Medium 2026-11-10 Not applicable No public exploit Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124930 Medium 2026-11-10 Not applicable No public exploit Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124929 Medium 2026-11-10 Not applicable No public exploit Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124925 Medium 2026-11-10 Not applicable No public exploit Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124909 Medium 2026-11-10 Not applicable No public exploit Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-119273 Medium 2026-11-10 Not applicable No public exploit The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls that are not enforced under all common web-server configurations, allowing unauthenticated attackers to read logged request data on affected deployments.
CVE-2026-109460 Medium 2026-11-10 Not applicable No public exploit Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disclose information locally.
CVE-2026-124834 Medium 2026-11-09 Not applicable No public exploit A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store_temporary_password of the file public/local/iomad/classes/company_user.php of the component Password Field Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The attack requires a high level of complexity. The exploitation is known to be difficult. The name of the patch is 0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.
CVE-2026-123808 Medium 2026-11-09 Not applicable Proof of concept only Nuxt UI is an intuitive Vue UI library powered by Reka UI and Tailwind CSS. Prior to 4.8.1, the server-rendered form element produced by UForm in src/runtime/components/Form.vue omits the method and action attributes and relies solely on the hydrated @submit.prevent handler to stop native submission. UAuthForm composes UForm and can render named credential fields, including an input with type password, inside the same markup. If a user submits before Vue hydration completes, or when the client bundle is blocked or unavailable, the browser performs its default GET submission and serializes the named fields into the current URL query string. The credentials can then appear in the address bar, browser history, reverse-proxy, CDN, or WAF request logs, and Referer headers sent with same-origin subresource requests. This issue is fixed in version 4.8.1.
CVE-2026-123145 Medium 2026-11-09 Not applicable No public exploit The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the database, readable by anyone with access to order data or the database. Version 10.9.0 stored the passwords. Version 10.9.1 stopped new ones from being stored but left existing ones in place, and version 11.1.0 removes them on update. Passwords stored this way should be considered exposed.
CVE-2026-123088 Medium 2026-11-09 Not applicable No public exploit The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate orders and disclose customers' personal data (name, email address, phone number and address).
CVE-2026-120409 Medium 2026-11-09 Not applicable No public exploit The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.
CVE-2026-111454 Medium 2026-11-09 Not applicable No public exploit Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
CVE-2026-8642 Medium 2026-11-08 Not applicable No public exploit IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versions.
CVE-2026-124443 Medium 2026-11-08 Not applicable No public exploit Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they are not permitted to access.
CVE-2026-123504 Medium 2026-11-08 Not applicable No public exploit Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_url values to post to receiving channels or reuse keys until rotated.
CVE-2026-122062 Medium 2026-11-08 Not applicable No public exploit The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted through the bundled forms.
CVE-2026-122060 Medium 2026-11-08 Not applicable No public exploit The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected posts.
CVE-2026-108284 Medium 2026-11-08 No exploit published No public exploit IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information.
CVE-2026-104337 Medium 2026-11-08 Not applicable No public exploit The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.
CVE-2026-103320 Medium 2026-11-08 No exploit published No public exploit IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information.
CVE-2026-93370 Medium 2026-11-07 Not applicable No public exploit The Paystack WooCommerce Payment Gateway plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.5 via the 'key' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including billing name, email address, phone number, billing address, shipping address, and purchased product list — embedded into page HTML via wp_localize_script by enumerating sequential order IDs. This is only exploitable when the merchant has enabled the optional custom metadata feature in the Paystack gateway settings.
CVE-2026-17231 Medium 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an observable response discrepancy.
CVE-2026-17144 Medium 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.
CVE-2026-121380 Medium 2026-11-07 Not applicable No public exploit The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.
CVE-2026-120520 Medium 2026-11-07 Not applicable No public exploit The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 13.2.2 via the 'img (or any key the publisher references in {{GET:key}})' parameter. This makes it possible for unauthenticated attackers to extract authenticated users' HttpOnly WordPress session cookies, specifically wordpress_logged_in_* tokens, by injecting a nested {{COOKIE:}} placeholder via a GET parameter that causes the victim's browser to transmit the cookie value to an attacker-controlled host as an image src URL. Exploitation requires that a site publisher has configured a public GreenShift Element image block whose src attribute contains a {{GET:}} placeholder, and that a logged-in user can be induced to open the attacker's crafted link — neither condition is part of the plugin's default state.
CVE-2026-118801 Medium 2026-11-07 Not applicable No public exploit The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.18.0 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full rendered body content of any password-protected post of any post type by embedding the shortcode with the target post's ID. Author-level attackers and above can additionally publish a post embedding the shortcode, exposing the password-protected content to unauthenticated visitors.
CVE-2026-62852 Medium 2026-11-06 Not applicable Proof of concept only FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversations. A restricted authenticated user can subscribe to predictable conv.<conversation_id> Polycast channels for other conversations in the same mailbox. New event payloads can expose complete replies, internal notes, recipient addresses, conversation state, assignee data, attachment names, and attachment URLs containing valid download tokens. This issue is fixed in version 1.8.226.
CVE-2026-62851 Medium 2026-11-06 Not applicable No public exploit FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, the search-by-number shortcut in ConversationsController::search() resolves a user-controlled ticket number without applying the mailbox filter or view policy used by the normal search path. An authenticated non-admin agent who is a member of at least one mailbox can request /search with a hash-prefixed ticket number and use the 302 Location header to confirm that a conversation exists in a different mailbox the agent cannot access and learn its internal conversation and folder identifiers. The destination conversation remains protected, so this issue does not disclose message content, attachments, or customer data. This issue is fixed in version 1.8.226.
CVE-2026-35113 Medium 2026-11-06 Not applicable No public exploit HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact under certain conditions.
CVE-2026-35112 Medium 2026-11-06 Not applicable No public exploit HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security impact under certain conditions.
CVE-2026-35111 Medium 2026-11-06 Not applicable No public exploit HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact under certain conditions.
CVE-2026-120415 Medium 2026-11-06 Not applicable No public exploit undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, the redirect interceptor strips sensitive headers such as Authorization, Cookie, Proxy-Authorization, and Host when a request is redirected to a different origin, but when request headers are supplied as an array of name and value tuples (a valid documented input, for example from Object.entries), the redirect handler misreads them as a flat list so the header names never match and the sensitive headers are not removed. If a header-normalizing interceptor such as cache or deduplicate is composed outside the redirect interceptor, it then serializes the retained headers onto the cross-origin request, disclosing the caller's origin-bound credentials to the unrelated redirect destination. This is a representation-dependent bypass of the cross-origin header stripping added in CVE-2024-30260. The issue is fixed in undici 7.30.2 and 8.12.4, and users should upgrade to one of those versions or later. As a workaround, supply request headers as a plain object or a flat name and value array rather than an array of tuples, or compose the redirect interceptor outside the normalizing interceptor.
CVE-2026-118188 Medium 2026-11-06 Not applicable No public exploit The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowing any authenticated user, including a Subscriber, to read the title, content and excerpt of any other user's private, draft, pending, scheduled or trashed post.
CVE-2026-90963 Medium 2026-11-05 Not applicable No public exploit The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent.
CVE-2026-85570 Medium 2026-11-05 Not applicable No public exploit The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any enrolled student to obtain them before submitting their attempt.
CVE-2026-83538 Medium 2026-11-05 Not applicable No public exploit Missing Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to disclose internal business records — including organization, employee, product catalog, and product-store data — by requesting several helper endpoints across the Human Resources, Catalog, and Order Manager applications that are configured to skip authentication and perform no permission check before returning the requested record. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
CVE-2026-73580 Medium 2026-11-05 Not applicable No public exploit Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows a remote unauthenticated attacker to recursively enumerate Human Resources organization and employee data, including department names and identifiers, employment position names and identifiers, employee party identifiers, position occupancy, and organization relationships, via a crafted partyId parameter. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
CVE-2026-49405 Medium 2026-11-05 Not applicable Proof of concept only OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the local server exposes the server-sent events endpoint at /events without bearer authentication, permits cross-origin browser access, and uses only a caller-supplied client_id to select WebChannelEvent objects from the process-wide event bus. An unauthenticated local client, or an attacker-hosted web page opened by the victim, can subscribe to another client's stream by supplying a known or guessed identifier; the fixed system identifier makes the proactive-message stream predictable. The exposed events can include complete assistant responses, streamed message content, tool names, tool arguments, and raw tool outputs intended for the local user interface. This issue is fixed in version 0.56.0.
CVE-2026-122154 Medium 2026-11-05 Not applicable No public exploit A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response.
CVE-2026-111769 Medium 2026-11-05 Not applicable No public exploit The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. Prior to 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/client, the HTTP client transports and OAuth client requests followed redirects to a different origin while retaining custom request headers and, for HTTP 307 or 308 responses, request bodies. The affected surfaces are StreamableHTTPClientTransport, SSEClientTransport, and OAuth client functions such as auth(). The trigger is an HTTP redirect to another origin. Custom headers and mcp-session-id can be re-sent to the redirected origin. HTTP 307 and 308 redirects can also re-send the request body. OAuth request bodies can contain refresh_token and client_secret values. Current runtimes already strip the Authorization header across origins. stdio clients do not use the affected HTTP path. A malicious or compromised MCP or authorization server could therefore receive API keys, session identifiers, OAuth refresh tokens, or OAuth client secrets. Restoring unrestricted redirect following after upgrading restores the exposure. This issue is fixed in @modelcontextprotocol/sdk 1.32.0 and @modelcontextprotocol/client 2.3.0.
CVE-2026-105971 Medium 2026-11-05 Not applicable No public exploit The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.
CVE-2026-103021 Medium 2026-11-05 Not applicable Proof of concept only OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate temp_authuserid and load that account's user_settings before authentication succeeds. Existing usernames can therefore cause an additional database query and may apply visible customized settings, while nonexistent usernames skip that behavior. A remote unauthenticated actor can use timing or page differences to enumerate valid accounts for later credential attacks. This issue is fixed in version 8.3.0.
CVE-2026-103020 Medium 2026-11-05 Not applicable No public exploit OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the webroot admin.php multisite administration page is enabled without an authentication check, reads database configuration from sqlconf.php, and connects to each configured site database. An unauthenticated network actor can obtain site identifiers, database names, site names, exact OpenEMR versions and patch levels, pending upgrade status, and direct login and patient-portal links. This issue is fixed in version 8.3.0.
CVE-2026-121747 Medium 2026-11-04 Not applicable No public exploit Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether `.nvmrc` is a symbolic link. A repository or archive that ships `.nvmrc` as a symlink to another file (for example `../../.npmrc`, or `/proc/self/environ` on Linux) makes a plain `nvm use`, `nvm install`, `nvm which`, `nvm exec`, `nvm run`, or `nvm-exec` read that file and print its contents in the invalid-`.nvmrc` message (even with `--silent`) or, for a one-line file, in the `Found ... with version <...>` message; with the README's zsh `load-nvmrc` or bash `cdnvm` hook installed, entering the directory is enough. nvm sends the content nowhere; the attacker learns it only where they can see the victim's output, such as a CI log for a contributed branch. Version 0.41.0 still follows a symlinked `.nvmrc`, so deliberate links to another version file keep working, but never prints its content, and accepts it only if it contains a version or the name of an existing alias; the README's bash `cdnvm` hook, which read `.nvmrc` itself, now gets the version from nvm, so users of that hook must also update their copy of it.
CVE-2026-121618 Medium 2026-11-04 Not applicable Proof of concept only A weakness has been identified in Linksys E5600 1.1.0.26. This affects an unknown part of the file /cgi-bin/fqc.cgi of the component Factory Quality Control. This manipulation causes information disclosure. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-118523 Medium 2026-11-04 Not applicable Working exploit published The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.
CVE-2026-118404 Medium 2026-11-04 Not applicable No public exploit The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user who obtains another shopper's saved-cart identifier to load that shopper's cart contents, including selected products, quantities and buyer-entered custom field data, into their own session.
CVE-2026-105191 Medium 2026-11-04 Not applicable No public exploit The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action that returns the stored before-and-after values of a record change, allowing any authenticated user, including Subscribers, to read other users' sensitive HR, CRM and Accounting data by enumerating record identifiers.
CVE-2025-71455 Medium 2026-11-04 Not applicable Proof of concept only vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions.
CVE-2026-95771 Medium 2026-11-03 Not applicable No public exploit An authenticated information disclosure vulnerability exists in an API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated remote attacker to obtain limited information about the affected system.
CVE-2026-95770 Medium 2026-11-03 Not applicable No public exploit A sensitive information disclosure vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low-privileged user with local access to view sensitive information, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information from the affected system.
CVE-2026-95767 Medium 2026-11-03 Not applicable No public exploit An unauthenticated information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information about the affected system.
CVE-2026-95766 Medium 2026-11-03 Not applicable No public exploit Sensitive information disclosure vulnerabilities in HPE Networking Fabric Composer could allow an authenticated attacker with low privileges to access sensitive information. Successful exploitation could allow an attacker to disclose sensitive information.
CVE-2026-95765 Medium 2026-11-03 Not applicable No public exploit A sensitive information disclosure vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information.
CVE-2026-95729 Medium 2026-11-03 Not applicable No public exploit A sensitive information disclosure vulnerability exists in HPE Networking VIA. Successful exploitation could allow an authenticated attacker to obtain sensitive information.
CVE-2026-121587 Medium 2026-11-03 Not applicable No public exploit Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate application names across all teams via manual GitHub, GitLab, Bitbucket and Gitea webhooks. Attackers can send a repository name of % or empty with a common branch like main, exploiting unescaped LIKE wildcards to receive every matching application name before signature verification.
CVE-2026-121509 Medium 2026-11-03 Not applicable Proof of concept only A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-121254 Medium 2026-11-03 Not applicable No public exploit Information leak in Select in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121243 Medium 2026-11-03 Not applicable No public exploit Information leak in Frames in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121239 Medium 2026-11-03 Not applicable No public exploit Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121235 Medium 2026-11-03 Not applicable No public exploit Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-121161 Medium 2026-11-03 Not applicable No public exploit Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121158 Medium 2026-11-03 Not applicable No public exploit Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121132 Medium 2026-11-03 Not applicable No public exploit Information leak in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-121125 Medium 2026-11-03 Not applicable No public exploit Information leak in ServiceWorker in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
‹ prev page 1 of 78 next ›