CVE-2026-66443 WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

CVE-2026-66443

CVE-2026-66443 affects the WordPress REST API Log plugin, specifically versions

EUVD-2026-57865

Subscriber Sensitive Data Exposure in WPJAM Basic = 7.0.2.1 versions...

CVE-2026-66432

CVE-2026-66432 affects the WordPress WPJAM Basic plugin, versions

CVE-2026-66432

Subscriber Sensitive Data Exposure in WPJAM Basic = 7.0.2.1 versions...

CVE-2026-66432 WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in WPJAM Basic = 7.0.2.1 versions...

EUVD-2026-57957

Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...

CVE-2026-28174

Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...

CVE-2026-28174

Technical details, affected components, exploit vectors, and remediation are not publicly provided in the supplied documents; monitor for updates.

CVE-2026-28174 WordPress WP Event SOlution plugin <= 4.1.18 - Sensitive Data Exposure vulnerability

Customer Sensitive Data Exposure in WP Event SOlution = 4.1.18 versions...

EUVD-2026-57948

Unauthenticated Insecure Direct Object References IDOR in Do Lasso = 358 versions...

CVE-2026-28156

Subscriber SQL Injection in Do Lasso = 358 versions...

CVE-2025-62318

CVE-2025-62318 affects HCL AION. The issue involves JavaScript responses that contain data being referenced by external pages, enabling potential JavaScript hijacking where an attacker-controlled page could capture sensitive information under certain conditions. The vulnerability is described wit...

MINI-879H-JQMR-HQ3V

Bulletin has no description...

ECHO-7458-DC2A-8577

Bulletin has no description...

EUVD-2026-57804

Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that allows authenticated attackers to access other customers' payment and profile data by manipulating the customerId parameter. Attackers can...

EUVD-2026-57770

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor...

WordPress KiviCare plugin < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability

Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR vulnerability discovered by Sai Praneeth Koti in WordPress Plugin KiviCare versions 4.5.2...

EUVD-2026-57727

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee provider is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data...

CVE-2026-19135

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an...