Overview 515 matches · 20 in Waratek scope · 0 protected · 8 exploited · 0 CISA KEV · 14 public PoC · 0 EPSS ≥ 0.5
515matches
20in Waratek scope3.9%
0protected0.0%
8exploited1.6%
0CISA KEV0.0%
14public PoC2.7%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
20
3.9%
Outside Waratek scope
2
0.4%
Not applicable
493
95.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
515
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 282 / year
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20140
20150
20160
20170
20185
No exploit published1
Not applicable4
Critical1
High2
Medium2
not blocked5
No public exploit5
20192
Not applicable2
Medium2
not blocked2
No public exploit2
202010
Not applicable10
Critical4
High1
Medium5
not blocked10
No public exploit10
20218
Not applicable8
Critical2
High1
Medium4
Low1
not blocked8
No public exploit8
20228
Not applicable8
High2
Medium5
Low1
not blocked8
No public exploit8
202318
No exploit published2
Not applicable16
Critical1
High3
Medium13
Low1
not blocked18
Proof of concept only9
No public exploit9
202442
No exploit published4
Not applicable38
Critical2
High16
Medium23
Low1
not blocked42
Exploited2
Working exploit published3
Proof of concept only3
No public exploit34
2025139
No exploit published7
Outside Waratek scope2
Not applicable130
Critical2
High36
Medium98
Low3
not blocked139
Exploited2
Working exploit published6
Proof of concept only8
No public exploit123
2026282
No exploit published6
Not applicable276
Critical14
High102
Medium156
Low9
Unknown1
not blocked282
Exploited4
Working exploit published1
Proof of concept only36
No public exploit241
2014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-126308 | High | 2026-11-13 | Not applicable | No public exploit | The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination. |
| CVE-2026-125802 | Medium | 2026-11-13 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5. |
| CVE-2026-121771 | Medium | 2026-11-13 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Gutenberg Blocks: from n/a through 3.7.6. |
| CVE-2026-87801 | Medium | 2026-11-12 | Not applicable | No public exploit | An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files. |
| CVE-2026-126331 | Unknown | 2026-11-11 | Not applicable | No public exploit | Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response. |
| CVE-2026-125777 | Medium | 2026-11-11 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6. |
| CVE-2026-125767 | Medium | 2026-11-11 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through 1.36.3.1. |
| CVE-2026-125766 | Medium | 2026-11-11 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allows Retrieve Embedded Sensitive Data.This issue affects WPZOOM Social Feed Widget & Block: from n/a through 2.4.1. |
| CVE-2026-125435 | Medium | 2026-11-11 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3. |
| CVE-2026-121674 | Medium | 2026-11-10 | Not applicable | No public exploit | Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-120006 | High | 2026-11-10 | Not applicable | No public exploit | Insertion of sensitive information into sent data in .NET Aspire allows an authorized attacker to elevate privileges locally. |
| CVE-2026-123551 | Critical | 2026-11-08 | Not applicable | No public exploit | OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions. |
| CVE-2026-123513 | High | 2026-11-08 | Not applicable | No public exploit | Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover. |
| CVE-2026-119465 | Medium | 2026-11-07 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through 1.15. |
| CVE-2026-71863 | Low | 2026-11-06 | Not applicable | No public exploit | SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the journalist alert key filename empty, causing the copy task to transfer every file in ~/.config/securedrop-admin/, including Onion Service client authentication credentials, to the Monitor Server. An attacker must first compromise the privileged Monitor Server to obtain the credentials, and the credentials remain an additional protection layer rather than sufficient access by themselves because the Journalist Interface still requires a username, passphrase, and MFA, while SSH access still requires SSH keys. This issue is fixed in version 2.16.1. |
| CVE-2026-123290 | Medium | 2026-11-06 | Not applicable | No public exploit | In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint |
| CVE-2026-119499 | High | 2026-11-06 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Retrieve Embedded Sensitive Data.This issue affects FloristPress: from n/a through 7.8.4. |
| CVE-2026-111753 | Medium | 2026-11-05 | Not applicable | No public exploit | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3. |
| CVE-2026-121554 | High | 2026-11-03 | Not applicable | No public exploit | cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, native iOS and Android stacks forward the Cookie header, letting attackers hijack user sessions. |
| CVE-2026-120716 | Medium | 2026-11-03 | Not applicable | No public exploit | Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response. |
| CVE-2026-115293 | Medium | 2026-11-03 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user. |
| CVE-2026-114183 | Medium | 2026-11-03 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0. |
| CVE-2026-88811 | Critical | 2026-11-02 | Not applicable | No public exploit | Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, |
| CVE-2026-119564 | Medium | 2026-10-30 | Not applicable | No public exploit | Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership. |
| CVE-2026-116861 | High | 2026-10-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. |
| CVE-2026-115947 | Medium | 2026-10-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. |
| CVE-2026-107268 | Medium | 2026-10-30 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2. |
| CVE-2026-48200 | Medium | 2026-10-29 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0. |
| CVE-2026-45049 | High | 2026-10-29 | No exploit published | No public exploit | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1. |
| CVE-2026-118083 | High | 2026-10-29 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. |
| CVE-2026-114173 | Medium | 2026-10-29 | Not applicable | No public exploit | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store. |
| CVE-2026-115591 | High | 2026-10-28 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by Supsystic: from n/a through 1.10.5. |
| CVE-2026-116689 | Medium | 2026-10-27 | Not applicable | Proof of concept only | follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2. |
| CVE-2026-115594 | Medium | 2026-10-26 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42. |
| CVE-2026-114190 | Medium | 2026-10-24 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9. |
| CVE-2026-53920 | High | 2026-10-23 | Not applicable | No public exploit | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3. |
| CVE-2026-114485 | Medium | 2026-10-22 | Not applicable | No public exploit | Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response. |
| CVE-2026-105777 | Medium | 2026-10-22 | Not applicable | No public exploit | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers. |
| CVE-2026-87863 | High | 2026-10-20 | Not applicable | Proof of concept only | An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache saves, the original HSTS file is truncated before writing a temporary replacement; when serialization fails, the temporary file is deleted, leaving an empty or partial cache. Because the save error is silently ignored during cleanup, curl exits successfully despite the data loss. |
| CVE-2026-87862 | High | 2026-10-20 | Not applicable | Proof of concept only | Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS. |
| CVE-2026-87861 | Critical | 2026-10-20 | Not applicable | Proof of concept only | When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via Negotiate for a different origin, leaving the request's intended credentials unused. |
| CVE-2026-86415 | High | 2026-10-20 | Not applicable | No public exploit | libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this. |
| CVE-2026-86414 | Critical | 2026-10-20 | Not applicable | Proof of concept only | An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the expected 407 `Proxy-Authenticate:`. |
| CVE-2026-86413 | Critical | 2026-10-20 | Not applicable | Proof of concept only | When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its credential details to an unrelated second origin when asked to redirect there. |
| CVE-2026-86409 | High | 2026-10-20 | Not applicable | Proof of concept only | Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL isset next, leaking state information. |
| CVE-2026-113459 | High | 2026-10-20 | Not applicable | No public exploit | In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured. |
| CVE-2026-19603 | Medium | 2026-10-16 | Not applicable | No public exploit | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints, without being a member of that channel. Mattermost Advisory ID: MMSA-2026-00765 |
| CVE-2026-19601 | Medium | 2026-10-16 | Not applicable | No public exploit | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature. Mattermost Advisory ID: MMSA-2026-00764 |
| CVE-2026-19541 | Medium | 2026-10-16 | Not applicable | No public exploit | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761 |
| CVE-2026-75559 | Medium | 2026-10-15 | Not applicable | No public exploit | The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted by the application, potentially leading to the exposure of API integration credentials such as an access ID and access key. |
| CVE-2026-110361 | Medium | 2026-10-15 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1. |
| CVE-2026-109695 | High | 2026-10-15 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1. |
| CVE-2026-89203 | Medium | 2026-10-13 | Not applicable | No public exploit | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities. |
| CVE-2026-66822 | Medium | 2026-10-13 | Not applicable | No public exploit | Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-52394 | Critical | 2026-10-13 | Not applicable | Proof of concept only | DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. |
| CVE-2026-108489 | Medium | 2026-10-13 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3. |
| CVE-2023-25996 | Medium | 2026-10-12 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0. |
| CVE-2026-107761 | Medium | 2026-10-11 | Not applicable | No public exploit | Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platform access token and refresh token. A third-party OAuth app permitted to delete a channel therefore receives that channel's social platform credentials and can use them against the connected account directly, outside Postiz. `GET /user/organizations` returns each organization row, including its API key, to every member of the organization. The API key is intended for admins only, so a member with a lower role can obtain it and call the public API on behalf of the organization. Both endpoints require a valid session, API key or OAuth token and are scoped to the caller's own organization. There is no anonymous access and no cross-tenant exposure. |
| CVE-2026-66435 | Medium | 2026-10-10 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This issue affects WP Rollback: from n/a through 3.1.2. |
| CVE-2026-62043 | High | 2026-10-10 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions. |
| CVE-2026-42630 | High | 2026-10-10 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions. |
| CVE-2026-42419 | Medium | 2026-10-10 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions. |
| CVE-2026-87109 | Medium | 2026-10-09 | Not applicable | No public exploit | An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project. |
| CVE-2026-105877 | Medium | 2026-10-09 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0. |
| CVE-2026-92555 | Critical | 2026-10-08 | Not applicable | No public exploit | Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26. |
| CVE-2026-107315 | Medium | 2026-10-08 | No exploit published | Proof of concept only | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same connection: SQL text and parameter values of recent statements, which on a pooled connection can come from other requests. Each padded value can carry up to 8192 bytes of this traffic, or 16320 bytes on a connection with GSS encryption. The padding happens when an application declares a length larger than the data it supplies, through PreparedStatement.setObject with a ByteStreamWriter, CopyIn.writeToCopy, PGCopyOutputStream.write, LargeObject.write, or Blob.setBytes. The driver accepts these calls without an error. An attacker who can make the application store such a value and read it back can collect earlier traffic. Applications whose declared lengths always match their data are not affected. Versions 42.7.3 and earlier pad with zeros. |
| CVE-2026-107313 | Medium | 2026-10-07 | No exploit published | Proof of concept only | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEncMode=prefer or require), and the server stores the value without an error. The buffer is 16320 bytes with MIT Kerberos. The stored value then holds bytes of the messages the driver sent just before it on the same connection, such as the statement's SQL text, its other parameters, and earlier rows of the same batch, instead of the bytes the application supplied. Values at least as long as the buffer are affected when the driver writes them from a byte array: bind parameters set with setString, setBytes, or a ByteStreamWriter, CopyIn.writeToCopy, and LargeObject.write. Most such writes fail with an ArrayIndexOutOfBoundsException instead. The default, gssEncMode=allow, does not start GSS encryption, and connections without GSS encryption are not affected. Versions 42.7.3 and earlier are not affected, and 42.7.6 fixes the problem. |
| CVE-2026-66666 | Medium | 2026-10-06 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9. |
| CVE-2026-42413 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions. |
| CVE-2026-41563 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions. |
| CVE-2026-41562 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions. |
| CVE-2026-41561 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions. |
| CVE-2026-41559 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions. |
| CVE-2026-39791 | Medium | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions. |
| CVE-2026-39729 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions. |
| CVE-2026-106501 | Critical | 2026-10-06 | Not applicable | No public exploit | Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0. |
| CVE-2026-105849 | High | 2026-10-06 | Not applicable | No public exploit | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. |
| CVE-2026-105071 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions. |
| CVE-2026-104399 | Medium | 2026-10-06 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124. |
| CVE-2026-104385 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions. |
| CVE-2026-105742 | Medium | 2026-10-05 | Not applicable | Proof of concept only | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every remote image URL named by an untrusted document when enable_remote_fetch=True and fetch_images=True. The loader does not restrict those credentials to the source document's origin, allowing requests that carry custom headers such as API keys and cookies to follow cross-origin redirects and expose the caller's configured credentials to a document author. The default configuration is not affected because remote fetching and configured headers are required. This issue is fixed in 2.132.0. |
| CVE-2026-105068 | Medium | 2026-10-05 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5. |
| CVE-2026-103335 | Medium | 2026-10-05 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Retrieve Embedded Sensitive Data.This issue affects Video Conferencing with Zoom: from n/a through 4.6.10. |
| CVE-2026-103334 | High | 2026-10-05 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservations: from n/a through 2.7.24. |
| CVE-2026-97307 | High | 2026-10-04 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17. |
| CVE-2026-104402 | Medium | 2026-10-04 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6. |
| CVE-2026-32584 | Medium | 2026-10-02 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup – Complete Demo Import & Export: from n/a through 1.4.3. |
| CVE-2026-103957 | High | 2026-10-02 | Not applicable | No public exploit | Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted discovery document address supplied when registering a tool server or remote agent configured for delegated authentication. To remediate this issue, users should upgrade to version 1.7.0 or later. |
| CVE-2026-62058 | Medium | 2026-10-01 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2. |
| CVE-2026-103345 | Medium | 2026-10-01 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13. |
| CVE-2026-103336 | Medium | 2026-10-01 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1. |
| CVE-2026-103281 | Medium | 2026-10-01 | Not applicable | No public exploit | Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users. |
| CVE-2026-103280 | Medium | 2026-10-01 | Not applicable | No public exploit | Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it. |
| CVE-2026-101322 | High | 2026-10-01 | Not applicable | No public exploit | In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a user to open a crafted Web UI link whose `aas` or `path` query parameter points to an attacker-controlled endpoint. The user's browser would then send the configured Basic Authentication credentials, Bearer token, or an available OAuth2 access token to that endpoint. The attacker could reuse the disclosed credential to access protected AAS services with the victim's privileges. The issue is fixed in v2-260924. |
| CVE-2026-97302 | Medium | 2026-09-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions. |
| CVE-2026-97261 | Medium | 2026-09-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. |
| CVE-2026-97241 | High | 2026-09-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions. |
| CVE-2026-97240 | High | 2026-09-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions. |
| CVE-2026-100258 | Medium | 2026-09-30 | Not applicable | No public exploit | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings |
| CVE-2026-86450 | High | 2026-09-29 | Not applicable | No public exploit | Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects DetaWix Mobile Web Portal: before v1.0.19. |