EUVD-2026-53895

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-66684

The CVE-2026-66684 entry concerns the WordPress plugin Export Import Menus, affected versions ≤ 1.9.2. The vulnerability is an unauthenticated sensitive data exposure in the export/import functionality. No concrete exploit details, affected files, root cause, or remediation are provided in the av...

CVE-2026-65543

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

CVE-2026-65543 WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

CVE-2026-65543

CVE-2026-65543 affects the WordPress Vimeo plugin (versions ≤ 1.2.2). The vulnerability is described as Subscriber Sensitive Data Exposure, with CVSS v3.1 Base Score 7.5 (HIGH) and an attack vector of NETWORK, requiring no privileges and no user interaction. The root cause and affected components...

EUVD-2026-53973

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

EUVD-2026-53947

Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier = 2.52.0 versions...

CVE-2026-28169

CVE-2026-28169 concerns unauthenticated sensitive data exposure in the WordPress plugin YITH WooCommerce Zoom Magnifier (versions

WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Export Import Menus versions = 1.9.2...

WordPress Custom CSS and JavaScript plugin <= 2.0.16 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Custom CSS and JavaScript versions = 2.0.16...

WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Featured Video Plus versions = 2.3.3...

urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers

A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...

EUVD-2026-53835

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2024-10302

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various...

EUVD-2026-53820

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...

CVE-2025-13909

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...

EUVD-2025-210630

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...

CVE-2024-10302

The CVE affects the user self-signup flow in multiple WSO2 products, where inadequate validation lets unvalidated input enter user claims. This can lead to downstream processing of malicious or malformed data, with potential content manipulation, redirection, UI inconsistencies, unauthorized acti...

CVE-2024-10302 Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure

The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various...

CVE-2026-14240

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...