Overview 309 matches · 12 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 6 public PoC · 0 EPSS ≥ 0.5
309matches
12in Waratek scope3.9%
0protected0.0%
1exploited0.3%
0CISA KEV0.0%
6public PoC1.9%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
12
3.9%
Outside Waratek scope
2
0.6%
Not applicable
295
95.5%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
309
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 156 / year
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20140
20150
20160
20170
20182
No exploit published1
Not applicable1
Medium2
not blocked2
No public exploit2
20192
Not applicable2
Medium2
not blocked2
No public exploit2
20205
Not applicable5
Medium5
not blocked5
No public exploit5
20214
Not applicable4
Medium4
not blocked4
No public exploit4
20225
Not applicable5
Medium5
not blocked5
No public exploit5
202313
No exploit published1
Not applicable12
Medium13
not blocked13
Proof of concept only7
No public exploit6
202423
No exploit published3
Not applicable20
Medium23
not blocked23
Working exploit published1
Proof of concept only1
No public exploit21
202598
No exploit published5
Outside Waratek scope2
Not applicable91
Medium98
not blocked98
Exploited1
Working exploit published4
Proof of concept only3
No public exploit90
2026156
No exploit published2
Not applicable154
Medium156
not blocked156
Proof of concept only13
No public exploit143
2014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-125802 | Medium | 2026-11-13 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5. |
| CVE-2026-121771 | Medium | 2026-11-13 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Gutenberg Blocks: from n/a through 3.7.6. |
| CVE-2026-87801 | Medium | 2026-11-12 | Not applicable | No public exploit | An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files. |
| CVE-2026-125777 | Medium | 2026-11-11 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6. |
| CVE-2026-125767 | Medium | 2026-11-11 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through 1.36.3.1. |
| CVE-2026-125766 | Medium | 2026-11-11 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allows Retrieve Embedded Sensitive Data.This issue affects WPZOOM Social Feed Widget & Block: from n/a through 2.4.1. |
| CVE-2026-125435 | Medium | 2026-11-11 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3. |
| CVE-2026-121674 | Medium | 2026-11-10 | Not applicable | No public exploit | Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-119465 | Medium | 2026-11-07 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through 1.15. |
| CVE-2026-123290 | Medium | 2026-11-06 | Not applicable | No public exploit | In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint |
| CVE-2026-111753 | Medium | 2026-11-05 | Not applicable | No public exploit | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3. |
| CVE-2026-120716 | Medium | 2026-11-03 | Not applicable | No public exploit | Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response. |
| CVE-2026-115293 | Medium | 2026-11-03 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated user with the privileges to onboard Observability data can obtain them. The user can then access Elasticsearch directly with the privileges of the Kibana service account, which are outside the privileges granted to that user. |
| CVE-2026-114183 | Medium | 2026-11-03 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0. |
| CVE-2026-119564 | Medium | 2026-10-30 | Not applicable | No public exploit | Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership. |
| CVE-2026-115947 | Medium | 2026-10-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. |
| CVE-2026-107268 | Medium | 2026-10-30 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2. |
| CVE-2026-48200 | Medium | 2026-10-29 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0. |
| CVE-2026-114173 | Medium | 2026-10-29 | Not applicable | No public exploit | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords and private product metadata from an affected store. |
| CVE-2026-116689 | Medium | 2026-10-27 | Not applicable | Proof of concept only | follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2. |
| CVE-2026-115594 | Medium | 2026-10-26 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42. |
| CVE-2026-114190 | Medium | 2026-10-24 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retrieve Embedded Sensitive Data.This issue affects LiteSpeed Cache: from n/a through 7.9. |
| CVE-2026-114485 | Medium | 2026-10-22 | Not applicable | No public exploit | Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response. |
| CVE-2026-105777 | Medium | 2026-10-22 | Not applicable | No public exploit | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have retrieved sensitive internal server credentials due to improper filtering of internal response headers. |
| CVE-2026-19603 | Medium | 2026-10-16 | Not applicable | No public exploit | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API endpoints, which allows an authenticated user to learn the channel ID of a private channel another user is actively viewing via the status endpoints, without being a member of that channel. Mattermost Advisory ID: MMSA-2026-00765 |
| CVE-2026-19601 | Medium | 2026-10-16 | Not applicable | No public exploit | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection settings (such as the server address) are changed, which allows a System Console administrator to disclose the plaintext bind password to an attacker-controlled server via the Test Connection / diagnostics feature. Mattermost Advisory ID: MMSA-2026-00764 |
| CVE-2026-19541 | Medium | 2026-10-16 | Not applicable | No public exploit | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an outgoing OAuth connection, which allows an authenticated user with permission to manage outgoing OAuth connections to obtain the secret via pointing the token URL at an attacker-controlled endpoint and triggering validation.. Mattermost Advisory ID: MMSA-2026-00761 |
| CVE-2026-75559 | Medium | 2026-10-15 | Not applicable | No public exploit | The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted by the application, potentially leading to the exposure of API integration credentials such as an access ID and access key. |
| CVE-2026-110361 | Medium | 2026-10-15 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1. |
| CVE-2026-89203 | Medium | 2026-10-13 | Not applicable | No public exploit | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities. |
| CVE-2026-66822 | Medium | 2026-10-13 | Not applicable | No public exploit | Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network. |
| CVE-2026-108489 | Medium | 2026-10-13 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3. |
| CVE-2023-25996 | Medium | 2026-10-12 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Booster Elite for WooCommerce: from n/a before 8.4.0. |
| CVE-2026-107761 | Medium | 2026-10-11 | Not applicable | No public exploit | Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive. The public API's channel delete returns the deleted integration row, including the channel's platform access token and refresh token. A third-party OAuth app permitted to delete a channel therefore receives that channel's social platform credentials and can use them against the connected account directly, outside Postiz. `GET /user/organizations` returns each organization row, including its API key, to every member of the organization. The API key is intended for admins only, so a member with a lower role can obtain it and call the public API on behalf of the organization. Both endpoints require a valid session, API key or OAuth token and are scoped to the caller's own organization. There is no anonymous access and no cross-tenant exposure. |
| CVE-2026-66435 | Medium | 2026-10-10 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This issue affects WP Rollback: from n/a through 3.1.2. |
| CVE-2026-42419 | Medium | 2026-10-10 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions. |
| CVE-2026-87109 | Medium | 2026-10-09 | Not applicable | No public exploit | An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project. |
| CVE-2026-105877 | Medium | 2026-10-09 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue affects QA Analytics: from n/a through 5.3.0.0. |
| CVE-2026-107315 | Medium | 2026-10-08 | No exploit published | Proof of concept only | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same connection: SQL text and parameter values of recent statements, which on a pooled connection can come from other requests. Each padded value can carry up to 8192 bytes of this traffic, or 16320 bytes on a connection with GSS encryption. The padding happens when an application declares a length larger than the data it supplies, through PreparedStatement.setObject with a ByteStreamWriter, CopyIn.writeToCopy, PGCopyOutputStream.write, LargeObject.write, or Blob.setBytes. The driver accepts these calls without an error. An attacker who can make the application store such a value and read it back can collect earlier traffic. Applications whose declared lengths always match their data are not affected. Versions 42.7.3 and earlier pad with zeros. |
| CVE-2026-107313 | Medium | 2026-10-07 | No exploit published | Proof of concept only | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEncMode=prefer or require), and the server stores the value without an error. The buffer is 16320 bytes with MIT Kerberos. The stored value then holds bytes of the messages the driver sent just before it on the same connection, such as the statement's SQL text, its other parameters, and earlier rows of the same batch, instead of the bytes the application supplied. Values at least as long as the buffer are affected when the driver writes them from a byte array: bind parameters set with setString, setBytes, or a ByteStreamWriter, CopyIn.writeToCopy, and LargeObject.write. Most such writes fail with an ArrayIndexOutOfBoundsException instead. The default, gssEncMode=allow, does not start GSS encryption, and connections without GSS encryption are not affected. Versions 42.7.3 and earlier are not affected, and 42.7.6 fixes the problem. |
| CVE-2026-66666 | Medium | 2026-10-06 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9. |
| CVE-2026-39791 | Medium | 2026-10-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions. |
| CVE-2026-104399 | Medium | 2026-10-06 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124. |
| CVE-2026-105742 | Medium | 2026-10-05 | Not applicable | Proof of concept only | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/image_resource_loader.py forwards headers configured through the HTMLBackendOptions.headers setting to every remote image URL named by an untrusted document when enable_remote_fetch=True and fetch_images=True. The loader does not restrict those credentials to the source document's origin, allowing requests that carry custom headers such as API keys and cookies to follow cross-origin redirects and expose the caller's configured credentials to a document author. The default configuration is not affected because remote fetching and configured headers are required. This issue is fixed in 2.132.0. |
| CVE-2026-105068 | Medium | 2026-10-05 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue affects Events Manager: from n/a through 7.4.5. |
| CVE-2026-103335 | Medium | 2026-10-05 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Retrieve Embedded Sensitive Data.This issue affects Video Conferencing with Zoom: from n/a through 4.6.10. |
| CVE-2026-104402 | Medium | 2026-10-04 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issue affects Mindio Magic MCP: from n/a through 0.5.6. |
| CVE-2026-32584 | Medium | 2026-10-02 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click-setup allows Retrieve Embedded Sensitive Data.This issue affects Smart One Click Setup – Complete Demo Import & Export: from n/a through 1.4.3. |
| CVE-2026-62058 | Medium | 2026-10-01 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2. |
| CVE-2026-103345 | Medium | 2026-10-01 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13. |
| CVE-2026-103336 | Medium | 2026-10-01 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1. |
| CVE-2026-103281 | Medium | 2026-10-01 | Not applicable | No public exploit | Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users. |
| CVE-2026-103280 | Medium | 2026-10-01 | Not applicable | No public exploit | Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it. |
| CVE-2026-97302 | Medium | 2026-09-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions. |
| CVE-2026-97261 | Medium | 2026-09-30 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. |
| CVE-2026-100258 | Medium | 2026-09-30 | Not applicable | No public exploit | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings |
| CVE-2026-82837 | Medium | 2026-09-15 | Not applicable | No public exploit | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to improper authorization checks on internal data emission endpoints. |
| CVE-2026-91198 | Medium | 2026-09-14 | Not applicable | No public exploit | GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text, schema, table names, filter values and datasource identifiers. |
| CVE-2026-89332 | Medium | 2026-09-11 | Not applicable | No public exploit | Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthenticated actors to obtain sensitive information from a developer workstation. Crafted repository content can cause the agent to modify the workspace settings file, which redirects the Kiro Powers registry request to an actor controlled endpoint and sends workspace data to that endpoint when the Powers panel is opened. To remediate this issue, users should upgrade to Kiro IDE version 0.8.135 or later. Users who opened a project in an earlier version should also rotate any credentials that were present in that project. |
| CVE-2026-62088 | Medium | 2026-09-11 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4. |
| CVE-2026-78374 | Medium | 2026-09-10 | Not applicable | No public exploit | Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes an action called contact that requires no authentication, no CSRF token, no captcha (when no captcha plugin is enabled) and has no rate limiting. The attacker fully controls the recipient, subject and HTML body, and the mail is sent from the site's configured sender identity (mailfrom/fromname). |
| CVE-2026-78303 | Medium | 2026-09-10 | Not applicable | No public exploit | Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously relied on client-submitted hidden fields for recipient routing, allowing potential email manipulation. |
| CVE-2026-87015 | Medium | 2026-09-09 | Not applicable | Proof of concept only | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection loop instead of binding it to each external tool callable. When multiple tool servers were attached and a session or system OAuth connection was processed last, a request to a different server configured for bearer authentication could include the calling user's Open WebUI session cookies, allowing that server's operator to reuse the session and take over the account. This issue is fixed in version 0.11.1. |
| CVE-2026-65812 | Medium | 2026-09-08 | Not applicable | No public exploit | Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. |
| CVE-2026-86497 | Medium | 2026-09-07 | Not applicable | No public exploit | In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials |
| CVE-2026-85307 | Medium | 2026-09-03 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08. |
| CVE-2026-81162 | Medium | 2026-09-02 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1. |
| CVE-2026-77123 | Medium | 2026-09-02 | Not applicable | No public exploit | Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. This issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x, and is fixed in version 3.96.0. |
| CVE-2026-81280 | Medium | 2026-08-31 | Not applicable | No public exploit | Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions. |
| CVE-2026-59809 | Medium | 2026-08-22 | Not applicable | No public exploit | SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored secrets. An MCP client can craft a request with an attacker-controlled URL containing secret placeholders to send plaintext secret values to any public host without confirmation. |
| CVE-2026-63481 | Medium | 2026-08-20 | Not applicable | No public exploit | Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0. |
| CVE-2026-74008 | Medium | 2026-08-18 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24. |
| CVE-2026-28174 | Medium | 2026-08-13 | Not applicable | No public exploit | Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions. |
| CVE-2026-16637 | Medium | 2026-08-07 | Not applicable | No public exploit | OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints. |
| CVE-2026-66696 | Medium | 2026-08-06 | Not applicable | No public exploit | Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions. |
| CVE-2026-66685 | Medium | 2026-08-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions. |
| CVE-2026-66684 | Medium | 2026-08-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions. |
| CVE-2026-66683 | Medium | 2026-08-06 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions. |
| CVE-2026-20484 | Medium | 2026-08-03 | Not applicable | No public exploit | In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11053160; Issue ID: MSV-8004. |
| CVE-2026-28144 | Medium | 2026-07-31 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6. |
| CVE-2026-65434 | Medium | 2026-07-27 | Not applicable | No public exploit | Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions. |
| CVE-2026-64643 | Medium | 2026-07-27 | Not applicable | No public exploit | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used. Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references). Affected users are applications using App Router and Server Actions. By itself, this disclosure is typically a recon/enumeration primitive; however, it can increase risk when combined with other weaknesses. This issue has been fixed in versions 15.5.21 and 16.2.11. |
| CVE-2026-66339 | Medium | 2026-07-24 | Not applicable | No public exploit | A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure. |
| CVE-2026-16798 | Medium | 2026-07-24 | Not applicable | No public exploit | Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token. |
| CVE-2026-27372 | Medium | 2026-07-23 | Not applicable | No public exploit | Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions. |
| CVE-2026-54171 | Medium | 2026-07-17 | Not applicable | No public exploit | Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial request includes header information that is not intended for the new target. This issue is fixed in version 1.5.0. |
| CVE-2026-44970 | Medium | 2026-07-16 | Not applicable | Proof of concept only | dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabs_vortex.producer.log_proto without redaction, including sql_query from show, vars from run, build, and test, and node_selection from compile, while usage_tracking_enabled in settings.py enabled telemetry by default unless DBT_SEND_ANONYMOUS_USAGE_STATS=false or DO_NOT_TRACK=1 was set. This issue is fixed in version 1.17.1. |
| CVE-2026-56460 | Medium | 2026-07-09 | Not applicable | No public exploit | HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system. |
| CVE-2026-1365 | Medium | 2026-07-09 | Not applicable | No public exploit | Insertion of sensitive information into sent data vulnerability in Sayax Energy Technologies Inc. OSOS allows Authentication Bypass. This issue affects OSOS: through 09072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2026-42505 | Medium | 2026-07-08 | Not applicable | No public exploit | Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. |
| CVE-2026-59519 | Medium | 2026-07-05 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Softaculous FormLayer allows Retrieve Embedded Sensitive Data. This issue affects FormLayer: from n/a through 1.0.6. |
| CVE-2026-59511 | Medium | 2026-07-05 | Not applicable | No public exploit | Insertion of Sensitive Information Into Sent Data vulnerability in Tim Strifler Exclusive Addons Elementor allows Retrieve Embedded Sensitive Data. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.9. |
| CVE-2026-57347 | Medium | 2026-07-02 | Not applicable | No public exploit | Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions. |
| CVE-2025-69132 | Medium | 2026-07-02 | Not applicable | No public exploit | Subscriber Sensitive Data Exposure in Corpkit <= 1.0.5 versions. |
| CVE-2026-13211 | Medium | 2026-07-01 | Not applicable | Proof of concept only | The genucenter web interface before version 8.0p11 unnecessarily exposes sensitive SNMP authentication and encryption keys in its HTTP responses to users with the “Service” or “Admin” role. |
| CVE-2026-12085 | Medium | 2026-06-30 | Not applicable | No public exploit | IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attacks against the system. |
| CVE-2026-13437 | Medium | 2026-06-29 | Not applicable | No public exploit | Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses. |
| CVE-2026-57318 | Medium | 2026-06-26 | Not applicable | No public exploit | Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions. |
| CVE-2026-55180 | Medium | 2026-06-25 | Not applicable | Proof of concept only | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml into registry request destinations and registry credentials. A malicious repository could cause dependency resolution to send victim environment secrets to an attacker-selected registry before lifecycle scripts run. This vulnerability is fixed in 10.34.2 and 11.5.3. |
| CVE-2026-22551 | Medium | 2026-06-18 | Not applicable | No public exploit | In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce the AI agent to construct image URLs encoding sensitive information from the workspace or conversation context, exfiltrating it to attacker-controlled servers. The workspace trust enforcement introduced in v1.71.0 mitigates the documented attack chain by disabling AI features in untrusted workspaces. |