Trinity Audio <= 5.21.0 - Information Exposure

The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the /admin/inc/phpinfo.php file that gets created on install. This makes it possible for...

Wavlink WL-WN533A8 M33A8.V5030.190716 - Information Disclosure

An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials. id: CVE-2022-48164 info: name: Wavlink WL-WN533A8 M33A8.V5030.190716 - Information...

WordPress 3D FlipBook <= 1.16.17 - Information Disclosure

WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions = 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3dsendpostsin, fb3dsendpostpages, fb3dsendpostsinpages, fb3dsendpostsinfirstpage, and fb3dsendpostfirstpage handlers are...

CVE-2025-56801

CVE-2025-56801 AES-CFB IV Generation Vulnerability in Reolink Desktop Application 1. Overview Name : Reolink Desktop Application Version : 8.18.12 Vendor : Reolink CWE : CWE-1204: Generation of Weak Initialization Vector IV, CWE-321: Use of Hard-coded Cryptographic Key CVSS : 5.1 MEDIUM Vector...

CVE-2026-25049

🚨 CVE-2026-25049 – n8n Unauthenticated Settings Disclosure 📌 Overview CVE ID: CVE-2026-25049 Affected Software: n8n Severity: Critical Category: Improper Access Control / Information Disclosure This vulnerability allows unauthenticated access to internal configuration data via a REST API endpoint...

CVE-2023-2916

CVE-2023-2916 CVE-2023-2916 PoC The InfiniteWP Client plugin for WordPress, in versions up to and including 1.11.1, is vulnerable to a Sensitive Information Exposure flaw. This vulnerability allows authenticated attackers with subscriber-level permissions or above to extract sensitive data,...

Scout2

AWS Scout2 .. image:: https://travis-ci.org/nccgroup/Scout2.svg?branch=master :target: https://travis-ci.org/nccgroup/Scout2 .. image:: https://coveralls.io/repos/github/nccgroup/Scout2/badge.svg?branch=master :target: https://coveralls.io/github/nccgroup/Scout2 .. image::...

CVE-2026-25049

🚨 CVE-2026-25049 – n8n Unauthenticated Settings Disclosure 📌 Overview CVE ID: CVE-2026-25049 Affected Software: n8n Severity: Critical Category: Improper Access Control / Information Disclosure This vulnerability allows unauthenticated access to internal configuration data via a REST API endpoint...

ROS-20261111-73-0069

The Erlang vulnerability is related to improper input of configuration data. Exploitation of this vulnerability can be carried out remotely...

CVE-2026-120823

A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluster-level privilege. This may result in...

CVE-2026-120823 Missing Authorization Check in MongoDB Server Aggregation Framework Leads to Unauthorized Access to Deployment-Wide Configuration Data

A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid credentials, including an account with no assigned roles, to read deployment-wide query configuration data that is otherwise restricted to a cluster-level privilege. This may result in...

CVE-2026-120823

A missing authorization check in the MongoDB Server aggregation framework allows a user with any valid credentials—including an account with no assigned roles—to access deployment-wide query configuration data . This data is normally restricted to cluster-level privileges, and unauthorized access...

Juniper Networks RPD DoS

The vulnerability in the Routing Protocol Daemon RPD for Juniper Networks Junos OS and Junos OS Evolved is related to improper input of configuration data. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

CVE-2026-17324

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function...

CVE-2026-17324

The software IBM API Connect versions 12.1.0.0 through 12.1.1.2 contains multiple vulnerabilities that could allow a remote attacker to perform unauthorized actions and access sensitive configuration data. The root cause is identified as missing authentication for a critical function (CWE-306). N...

CVE-2026-17324 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function...

EUVD-2026-118715

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to access sensitive configuration data and perform unauthorized actions due to missing authentication for a critical function...

CVE-2026-17278 Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a...

EUVD-2026-118671

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to gain unauthorized access to sensitive API catalog and runtime configuration data due to improper authentication. Information supplied by the client is not sufficiently verified, which could allow a caller to appear as a...

PT-2026-139076

Name of the Vulnerable Software and Affected Versions IBM API Connect versions 12.1.0.0 through 12.1.1.2 Description A critical flaw exists where missing authentication for a critical function allows a remote attacker to access sensitive configuration data and perform unauthorized actions...