CVE-2026-64892

Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This issue affects Easy IO Neo: before 3.3b63...

CVE-2026-64892

The Johnson Controls Easy IO Neo (specifically EC and CW Controllers ) is vulnerable to an Exposure of Sensitive Information vulnerability affecting versions before 3.3b63 . The flaw allows an attacker to collect data from common resource locations, potentially providing access to sensitive infor...

CVE-2026-64892

Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This issue affects Easy IO Neo: before 3.3b63...

GO-2026-6491 RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields in github.com/rabbitmq/amqp091-go

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields in github.com/rabbitmq/amqp091-go...

WordPress Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget vulnerability

Authenticated Subscriber+ Sensitive Information Exposure in Form Submissions Dashboard Widget vulnerability discovered by Jakub Herman in WordPress Plugin Otter - Gutenberg Block versions = 3.2.6...

lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

SummaryThe LightRAG API server passes raw Python exception messages directly into HTTPerror responses across 30+ error handlers in every router. When combined withthe default unauthenticated configuration see companion report on CWE-306, anynetwork-reachable client can trigger exceptions whose ra...

PYSEC-2026-4063 lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error Responses

Summary The LightRAG API server passes raw Python exception messages directly into HTTP error responses across 30+ error handlers in every router. When combined with the default unauthenticated configuration see companion report on CWE-306, any network-reachable client can trigger exceptions whos...

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

SummaryThe dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

SummaryThe built-in knowledge search tool returns knowledge bases the calling user has no access to. The tool works out which knowledge bases the caller may read and hands that set to the vector store as a search filter, and that filter is the only access control on the path. Most of the shipped...

CVE-2026-47360

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...

ALPINE-CVE-2026-47360

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...

AZL-106767 CVE-2026-47360 affecting package httpd 2.4.68-1

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0...

CVE-2026-47360

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's modsessioncookie module. When SessionCookieRemove changes across internal redirects, the session cookie may still be passed to a backend server. This issue affects Apache HTTP Server: from 2.4.0 throu...

CVE-2026-47360

The Apache HTTP Server (versions 2.4.0 through 2.4.68 ) is vulnerable to an Exposure of Sensitive Information to an Unauthorized Actor vulnerability within the mod_session_cookie module. The root cause is that when the SessionCookieRemove directive changes across internal redirects, the session c...

NPM: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

NPM: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes childprocess vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

CVE-2026-62058 WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

CVE-2026-62058 WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

CVE-2026-62058

The WordPress CF7 Apps plugin (versions

WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Romain Deperne in WordPress Plugin CF7 Apps versions = 3.7.2...

CVE-2026-103345 WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...