CVE-2026-16954

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-14240

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an expor...

Information Disclosure

undici is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper parsing of whitespace around qualified Cache-Control directives, causing authenticated responses to be incorrectly stored in shared caches and potentially served to unauthorized users...

EUVD-2026-53726

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-16954 AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-16954

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

Johnson Controls Inc. TL280

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for...

Medixant RadiAnt DICOM

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to cause the application to crash if a maliciously crafted DICOM file is opened. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this...

SUSE CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

CVE-2026-19027

The H5Znbitdecompressonebyte, H5Znbitdecompressonenooptype, and H5Znbitdecompressoneatomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap...

The vulnerability of the kfd_event_page_set() function in the drivers/gpu/drm/amd/amdkfd/kfd_events.c module of the Direct Rendering Infrastructure (DRI) driver for AMD graphics cards in Linux operating systems allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the kfdeventpageset function in the drivers/gpu/drm/amd/amdkfd/kfdevents.c module of the Direct Rendering Infrastructure DRI driver for AMD graphics cards in Linux operating systems is related to out-of-buffer writing. Exploiting this vulnerability could allow an attacker to...

The vulnerability of the spectre_bhb_loop_affected() function in the arch/arm64/kernel/proton-pack.c module, which is part of the ARM 64-bit kernel support for the Linux operating system, allows a hacker to trigger a service failure.

The vulnerability of the spectrebhbloopaffected function in the arch/arm64/kernel/proton-pack.c module, which is part of the ARM 64-bit kernel support for the Linux operating system, relates to insufficient protection of sensitive data. Exploiting this vulnerability could allow an attacker to cau...

The vulnerability of the switchtec_ntb_init_mw() function in the drivers/ntb/hw/mscc/ntb_hw_switchtec.c driver for Linux’s non-visible kernel bridges allows a attacker to access protected information or cause service failures.

The vulnerability of the switchtecntbinitmw function in the drivers/ntb/hw/mscc/ntbhwswitchtec.c driver for Linux’s non-visible kernel bridges is related to reading beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to access protected information or cause service...

The vulnerability of the scarlett2_usb_get_config() function in the sound/usb/mixer_scarlett2.c module, which supports USB audio devices in Linux operating systems, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the scarlett2usbgetconfig function in the sound/usb/mixerscarlett2.c module, which supports USB audio devices in Linux operating systems, is related to incorrect calculation of the buffer size. Exploiting this vulnerability could allow an attacker to compromise the...

The vulnerability of the bond_enslave() function in the drivers/net/bonding/bond_main.c file of the Linux kernel-based network device driver allows a attacker to access protected information or cause service failure.

The vulnerability of the bondenslave function in the drivers/net/bonding/bondmain.c file of the Linux kernel network device driver is related to the execution of operations outside of the buffer boundaries. Exploiting this vulnerability could allow an attacker to access protected information or...

CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

EUVD-2026-53684

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-67531

CVE-2026-67531 affects FrontMCP before 1.5.7. The sandboxed codecall:execute tool could leak live host Zod schema instances to scripts via getTool, and due to Zod v4 _zod being non-configurable/non-writable, the ECMAScript Proxy invariant returned the raw host object. This allowed a script to rea...

CVE-2026-67531 FrontMCP: CodeCall sandbox escape -> host RCE via live Zod schema exposure by getTool

FrontMCP is a TypeScript-first framework for the Model Context Protocol MCP. Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool, and because Zod v4 defines zod as a non-configurable, non-writable own property, the ECMAScript Proxy...

CVE-2026-71316

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for //payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed...