Overview 441 matches · 16 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
441matches
16in Waratek scope3.6%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
16
3.6%
Outside Waratek scope
2
0.5%
Not applicable
423
95.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
441
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
441
100.0%
split by
peak 241 / year
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20140
20150
20160
20170
20185
No exploit published1
Not applicable4
Critical1
High2
Medium2
not blocked5
No public exploit5
20192
Not applicable2
Medium2
not blocked2
No public exploit2
202010
Not applicable10
Critical4
High1
Medium5
not blocked10
No public exploit10
20218
Not applicable8
Critical2
High1
Medium4
Low1
not blocked8
No public exploit8
20228
Not applicable8
High2
Medium5
Low1
not blocked8
No public exploit8
20239
No exploit published2
Not applicable7
Critical1
High1
Medium6
Low1
not blocked9
No public exploit9
202434
No exploit published4
Not applicable30
Critical1
High12
Medium21
not blocked34
No public exploit34
2025123
No exploit published6
Outside Waratek scope2
Not applicable115
Critical2
High28
Medium90
Low3
not blocked123
No public exploit123
2026241
No exploit published3
Not applicable238
Critical7
High82
Medium143
Low8
Unknown1
not blocked241
No public exploit241
2014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-126308 | High | 2026-11-13 | Not applicable | No public exploit | The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination. |
| CVE-2026-125802 | Medium | 2026-11-13 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5. |
| CVE-2026-121771 | Medium | 2026-11-13 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Gutenberg Blocks: from n/a through 3.7.6. |
| CVE-2026-87801 | Medium | 2026-11-12 | Not applicable | No public exploit | An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files. |
| CVE-2026-126331 | Unknown | 2026-11-11 | Not applicable | No public exploit | Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response. |
| CVE-2026-125777 | Medium | 2026-11-11 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6. |
| CVE-2026-125767 | Medium | 2026-11-11 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through 1.36.3.1. |
| CVE-2026-125766 | Medium | 2026-11-11 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allows Retrieve Embedded Sensitive Data.This issue affects WPZOOM Social Feed Widget & Block: from n/a through 2.4.1. |
| CVE-2026-125435 | Medium | 2026-11-11 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3. |
| CVE-2026-121674 | Medium | 2026-11-10 | Not applicable | No public exploit | Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-120006 | High | 2026-11-10 | Not applicable | No public exploit | Insertion of sensitive information into sent data in .NET Aspire allows an authorized attacker to elevate privileges locally. |
| CVE-2026-123551 | Critical | 2026-11-08 | Not applicable | No public exploit | OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints, collecting iPlanetDirectoryPro tokens to hijack user and administrator sessions. |
| CVE-2026-123513 | High | 2026-11-08 | Not applicable | No public exploit | Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover. |
| CVE-2026-119465 | Medium | 2026-11-07 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through 1.15. |
| CVE-2026-71863 | Low | 2026-11-06 | Not applicable | No public exploit | SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.13.0 until 2.16.1, running the securedrop-admin install Ansible playbook with journalist alerts disabled leaves the journalist alert key filename empty, causing the copy task to transfer every file in ~/.config/securedrop-admin/, including Onion Service client authentication credentials, to the Monitor Server. An attacker must first compromise the privileged Monitor Server to obtain the credentials, and the credentials remain an additional protection layer rather than sufficient access by themselves because the Journalist Interface still requires a username, passphrase, and MFA, while SSH access still requires SSH keys. This issue is fixed in version 2.16.1. |
| CVE-2026-123290 | Medium | 2026-11-06 | Not applicable | No public exploit | In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint |
| CVE-2026-119499 | High | 2026-11-06 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Retrieve Embedded Sensitive Data.This issue affects FloristPress: from n/a through 7.8.4. |
| CVE-2026-111753 | Medium | 2026-11-05 | Not applicable | No public exploit | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3. |
| CVE-2026-121554 | High | 2026-11-03 | Not applicable | No public exploit | cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to another host via an open or attacker-influenced redirect, native iOS and Android stacks forward the Cookie header, letting attackers hijack user sessions. |
| CVE-2026-120716 | Medium | 2026-11-03 | Not applicable | No public exploit | Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response. |
| CVE-2026-115293 | Medium | 2026-11-03 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user. |
| CVE-2026-114183 | Medium | 2026-11-03 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0. |
| CVE-2026-88811 | Critical | 2026-11-02 | Not applicable | No public exploit | Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, |
| CVE-2026-119564 | Medium | 2026-10-30 | Not applicable | No public exploit | Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership. |
| CVE-2026-116861 | High | 2026-10-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. |
| CVE-2026-115947 | Medium | 2026-10-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. |
| CVE-2026-107268 | Medium | 2026-10-30 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2. |
| CVE-2026-48200 | Medium | 2026-10-29 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0. |
| CVE-2026-45049 | High | 2026-10-29 | No exploit published | No public exploit | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an authenticated victim to visit a crafted URL can receive the session credential and potentially hijack the session. Deployments must have `CDSSO` enabled, as is common in multi-domain deployments, and exploitation is additionally gated on a non-default configuration being absent. This issue is fixed in version 16.1.1. |
| CVE-2026-118083 | High | 2026-10-29 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. |
| CVE-2026-114173 | Medium | 2026-10-29 | Not applicable | No public exploit | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store. |
| CVE-2026-115591 | High | 2026-10-28 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Retrieve Embedded Sensitive Data.This issue affects Contact Form by Supsystic: from n/a through 1.10.5. |
| CVE-2026-115594 | Medium | 2026-10-26 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42. |
| CVE-2026-114190 | Medium | 2026-10-24 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9. |
| CVE-2026-53920 | High | 2026-10-23 | Not applicable | No public exploit | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. From version 17.01.0 to before version 25.12.3, odhcpd's DHCPv6 IA parser accepts an IA_NA or IA_PD option whose body is shorter than struct dhcpv6_ia_hdr, casts the option header to that full structure, and reads ia->iaid before proving that the IA body contains the IAID field. If an unauthenticated network-adjacent client places a zero-length or otherwise short IA option at the end of odhcpd's 8192-byte receive stack buffer, the IAID read crosses from data_buf into adjacent stack memory. The disclosed bytes are then reflected in the DHCPv6 reply IAID; prior ARM validation showed data_buf[8192:8196] disclosing the saved stack canary, and wider stack scans can leak ASLR-useful stack/process contents. This issue has been patched in version 25.12.3. |
| CVE-2026-114485 | Medium | 2026-10-22 | Not applicable | No public exploit | Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response. |
| CVE-2026-105777 | Medium | 2026-10-22 | Not applicable | No public exploit | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers. |
| CVE-2026-86415 | High | 2026-10-20 | Not applicable | No public exploit | libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option for that transfer to prevent exactly this. |
| CVE-2026-113459 | High | 2026-10-20 | Not applicable | No public exploit | In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured. |
| CVE-2026-19603 | Medium | 2026-10-16 | Not applicable | No public exploit | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints, without being a member of that channel. Mattermost Advisory ID: MMSA-2026-00765 |
| CVE-2026-19601 | Medium | 2026-10-16 | Not applicable | No public exploit | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature. Mattermost Advisory ID: MMSA-2026-00764 |
| CVE-2026-19541 | Medium | 2026-10-16 | Not applicable | No public exploit | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761 |
| CVE-2026-75559 | Medium | 2026-10-15 | Not applicable | No public exploit | The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted by the application, potentially leading to the exposure of API integration credentials such as an access ID and access key. |
| CVE-2026-110361 | Medium | 2026-10-15 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1. |
| CVE-2026-109695 | High | 2026-10-15 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1. |
| CVE-2026-89203 | Medium | 2026-10-13 | Not applicable | No public exploit | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities. |
| CVE-2026-66822 | Medium | 2026-10-13 | Not applicable | No public exploit | Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-108489 | Medium | 2026-10-13 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3. |
| CVE-2023-25996 | Medium | 2026-10-12 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0. |
| CVE-2026-107761 | Medium | 2026-10-11 | Not applicable | No public exploit | Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platform access token and refresh token. A third-party OAuth app permitted to delete a channel therefore receives that channel's social platform credentials and can use them against the connected account directly, outside Postiz. `GET /user/organizations` returns each organization row, including its API key, to every member of the organization. The API key is intended for admins only, so a member with a lower role can obtain it and call the public API on behalf of the organization. Both endpoints require a valid session, API key or OAuth token and are scoped to the caller's own organization. There is no anonymous access and no cross-tenant exposure. |
| CVE-2026-66435 | Medium | 2026-10-10 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This issue affects WP Rollback: from n/a through 3.1.2. |
| CVE-2026-62043 | High | 2026-10-10 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions. |
| CVE-2026-42630 | High | 2026-10-10 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions. |
| CVE-2026-42419 | Medium | 2026-10-10 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions. |
| CVE-2026-87109 | Medium | 2026-10-09 | Not applicable | No public exploit | An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project. |
| CVE-2026-105877 | Medium | 2026-10-09 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0. |
| CVE-2026-92555 | Critical | 2026-10-08 | Not applicable | No public exploit | Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26. |
| CVE-2026-66666 | Medium | 2026-10-06 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9. |
| CVE-2026-42413 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions. |
| CVE-2026-41563 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions. |
| CVE-2026-41562 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions. |
| CVE-2026-41561 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions. |
| CVE-2026-41559 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions. |
| CVE-2026-39791 | Medium | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions. |
| CVE-2026-39729 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions. |
| CVE-2026-106501 | Critical | 2026-10-06 | Not applicable | No public exploit | Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0. |
| CVE-2026-105849 | High | 2026-10-06 | Not applicable | No public exploit | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API keys and exercise the target accounts' permissions until those keys are rotated or disabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34. |
| CVE-2026-105071 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions. |
| CVE-2026-104399 | Medium | 2026-10-06 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124. |
| CVE-2026-104385 | High | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions. |
| CVE-2026-105068 | Medium | 2026-10-05 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5. |
| CVE-2026-103335 | Medium | 2026-10-05 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Retrieve Embedded Sensitive Data.This issue affects Video Conferencing with Zoom: from n/a through 4.6.10. |
| CVE-2026-103334 | High | 2026-10-05 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservations: from n/a through 2.7.24. |
| CVE-2026-97307 | High | 2026-10-04 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sensitive Data.This issue affects Cost Calculator Builder: from n/a through 4.0.17. |
| CVE-2026-104402 | Medium | 2026-10-04 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6. |
| CVE-2026-32584 | Medium | 2026-10-02 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup – Complete Demo Import & Export: from n/a through 1.4.3. |
| CVE-2026-103957 | High | 2026-10-02 | Not applicable | No public exploit | Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary internal network locations, via a crafted discovery document address supplied when registering a tool server or remote agent configured for delegated authentication. To remediate this issue, users should upgrade to version 1.7.0 or later. |
| CVE-2026-62058 | Medium | 2026-10-01 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2. |
| CVE-2026-103345 | Medium | 2026-10-01 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13. |
| CVE-2026-103336 | Medium | 2026-10-01 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1. |
| CVE-2026-103281 | Medium | 2026-10-01 | Not applicable | No public exploit | Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users. |
| CVE-2026-103280 | Medium | 2026-10-01 | Not applicable | No public exploit | Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it. |
| CVE-2026-101322 | High | 2026-10-01 | Not applicable | No public exploit | In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorization` header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a user to open a crafted Web UI link whose `aas` or `path` query parameter points to an attacker-controlled endpoint. The user's browser would then send the configured Basic Authentication credentials, Bearer token, or an available OAuth2 access token to that endpoint. The attacker could reuse the disclosed credential to access protected AAS services with the victim's privileges. The issue is fixed in v2-260924. |
| CVE-2026-97302 | Medium | 2026-09-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions. |
| CVE-2026-97261 | Medium | 2026-09-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. |
| CVE-2026-97241 | High | 2026-09-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions. |
| CVE-2026-97240 | High | 2026-09-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions. |
| CVE-2026-100258 | Medium | 2026-09-30 | Not applicable | No public exploit | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings |
| CVE-2026-86450 | High | 2026-09-29 | Not applicable | No public exploit | Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects DetaWix Mobile Web Portal: before v1.0.19. |
| CVE-2026-54649 | Low | 2026-09-17 | Not applicable | No public exploit | punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-To header intended to route responses through the relay. When a correspondent sends mail to an alias and the operator replies, the mail client can send directly to the correspondent from the private FORWARD_TO inbox address, exposing that address. The disclosure is limited to the operator's own email address and does not expose third-party data or provide code execution or authentication bypass. This issue is fixed in version 1.5.0. |
| CVE-2026-82837 | Medium | 2026-09-15 | Not applicable | No public exploit | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to improper authorization checks on internal data emission endpoints. |
| CVE-2026-91198 | Medium | 2026-09-14 | Not applicable | No public exploit | GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text, schema, table names, filter values and datasource identifiers. |
| CVE-2026-78336 | High | 2026-09-14 | No exploit published | No public exploit | Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless of the entitlements owned by the caller. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue. |
| CVE-2026-89332 | Medium | 2026-09-11 | Not applicable | No public exploit | Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the workspace settings file, which redirects the Kiro Powers registry request to an actor controlled endpoint and sends workspace data to that endpoint when the Powers panel is opened. To remediate this issue, users should upgrade to Kiro IDE version 0.8.135 or later. Users who opened a project in an earlier version should also rotate any credentials that were present in that project. |
| CVE-2026-62088 | Medium | 2026-09-11 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4. |
| CVE-2026-81804 | High | 2026-09-10 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions. |
| CVE-2026-78374 | Medium | 2026-09-10 | Not applicable | No public exploit | Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled) and has no rate limiting. The attacker fully controls the recipient, subject and HTML body, and the mail is sent from the site's configured sender identity (mailfrom/fromname). |
| CVE-2026-78303 | Medium | 2026-09-10 | Not applicable | No public exploit | Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potential email manipulation. |
| CVE-2026-65812 | Medium | 2026-09-08 | Not applicable | No public exploit | Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. |
| CVE-2026-86505 | Low | 2026-09-07 | Not applicable | No public exploit | In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace |