CVE-2026-103345 WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

CVE-2026-103345

The Pie Register WordPress plugin (versions

CVE-2026-103345 WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Pie Register versions = 3.8.4.13...

CVE-2026-103336

The WP Ultimate CSV Importer plugin by Smackcoders Inc. (versions up to and including 9.1 ) is vulnerable to a Sensitive Data Exposure issue. The vulnerability, categorized as Insertion of Sensitive Information Into Sent Data , allows an attacker to Retrieve Embedded Sensitive Data from the plugi...

CVE-2026-103336 WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1...

CVE-2026-103336 WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1...

WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Ultimate CSV Importer versions = 9.1...

CVE-2026-82806

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended...

CVE-2026-103258

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameter...

CVE-2026-82806 Apache APISIX: cross-request permission pollution via static permission list mutation

Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a supported authz-keycloak configuration, a request's authorization scope could persist into later requests on the same route, leading to unintended...

CVE-2026-103281

The Ghost (npm package 'ghost') content management system versions 3.23.0 up to, but not including, 6.23.0 contains a vulnerability where it exposes API keys to users with low-privilege staff accounts. The root cause allows an authenticated low-privilege staff user to read API keys returned by th...

CVE-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

CVE-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

CVE-2026-103281 Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

Ghost npm package 'ghost' versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated low-privilege staff user can read API keys returned by the Admin API, which are intended to be available only to higher-privileged users...

EUVD-2026-90652

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, and ServiceNow nodes that allows attackers to bypass filters by breaking out of query literals. Attackers can exploit this by binding vulnerable node parameter...

BIT-RABBITMQ-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused isauthorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding...

WordPress Simply Schedule Appointments plugin <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.32...

CVE-2026-103544

A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the file backend/app/modules/ai/aiclient.py of the component Al Provider Configuration Handler. Performing a manipulation results in exposure of data element to wro...

CVE-2026-103544

A vulnerability exists in datadrivenconstruction OpenConstructionERP up to version 14.8.1 within the AI Provider Configuration Handler component. Specifically, an unknown function in the file backend/app/modules/ai/ai_client.py allows for data manipulation that results in the exposure of data ele...