EUVD-2026-91852

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obta...

CVE-2026-104476

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obta...

CVE-2026-104476: Exposure of Sensitive Information to an Unauthorized Actor

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with configuration export permission to obta...

CVE-2026-104476

Backdrop CMS versions prior to 1.35.1 are susceptible to an information disclosure vulnerability. This flaw allows unauthenticated attackers to retrieve configuration export archives that remain on the server after a transfer is completed. By downloading these compressed archives, an attacker can...

PT-2026-104458

Name of the Vulnerable Software and Affected Versions Backdrop CMS versions prior to 1.35.1 Description An information disclosure issue allows unauthenticated attackers to retrieve configuration export archives remaining on the server after transfer. By downloading these compressed archives, whic...

CVE-2026-17014 WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores...

CVE-2026-17014

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public REST endpoint actions, allowing unauthenticated users to delete the generated album export ZIP archives it stores...