1981 matches found
PT-2026-106030
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/slug/projects/project id/members/ returns the complete project-member roster, including each member's email address, first and last name, display name, avatar, and role. ProjectMemberPermission gates the...
EUVD-2026-91949
The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...
CVE-2026-96962
The Pie Register WordPress plugin (versions prior to 3.8.4.14 ) contains a vulnerability where it fails to restrict access to an invitation-code report . This flaw allows unauthenticated visitors to obtain the usernames and email addresses of all users who registered using a specific, known invit...
EUVD-2026-91890
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the getuserprofilestructure. This makes it possible for...
PT-2026-104535
Name of the Vulnerable Software and Affected Versions The Pie Register WordPress plugin versions prior to 3.8.4.14 Description The plugin fails to restrict access to an invitation-code report. This allows unauthenticated visitors who possess a valid invitation code to retrieve the usernames and...
CVE-2026-96962: Exposure of Sensitive Information to an Unauthorized Actor
The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...
CVE-2026-104439
YesWiki versions prior to 4.6.7 are vulnerable to a user enumeration vulnerability within the LostPasswordAction.php component. Unauthenticated attackers can confirm registered email addresses by submitting emails to the MotDePassePerdu recovery page and analyzing the differing responses. The lac...
Insertion of Sensitive Information Into Sent Data
Overview ghost is a publishing platform Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the GET /authentication/setup endpoint, which returns the owner user's name and email address even after site setup has been completed. An...
CVE-2026-103280
Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it...
CVE-2026-103280 Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint
Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated requests with the site owner's email address, allowing any remote visitor to obtain it...
CVE-2026-103280
The Ghost content management system, versions 0.8.0 before 6.23.0 , is susceptible to an information disclosure vulnerability. The setup endpoint fails to perform proper authentication and responds to unauthenticated requests by revealing the site owner's email address . This allows any remote vi...
CLEANSTART-2026-QF93365 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322
CVE-2026-42499 affects multiple packages. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322. See references for individual vulnerability details...
PT-2026-103812
Name of the Vulnerable Software and Affected Versions Ghost versions 0.8.0 through 6.22.9 Description An information disclosure issue exists in the setup endpoint. This endpoint responds to unauthenticated requests by revealing the site owner's email address, which allows any remote visitor to...
CVE-2026-100143 FluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email
The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address...
PT-2026-103021
The FluentCart A New Era of eCommerce WordPress plugin before 1.6.5 does not verify that the person placing a guest checkout controls the email address supplied, allowing unauthenticated attackers who know an existing guest customer's email to obtain a logged-in account bearing that address...
EUVD-2026-87896
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address t...
CVE-2026-100672 grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure
The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...
CVE-2026-100672 grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure
The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...
CLEANSTART-2026-GQ93723 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322
Security vulnerability affects the loki package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...
CVE-2026-100672: Missing Authentication for Critical Function
The Comments plugin getgrav/grav-plugin-comments for Grav CMS through version 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check. The handler branches on isAdmin, which only indicates that the admin service is registered on the current route rathe...