WP Booking System <= 2.1.0.3 - Unauthenticated Email Log Disclosure

WP Booking System – Booking Calendar plugin for WordPress = 2.1.0.3 contains an authorization bypass caused by improper user authorization verification, letting unauthenticated attackers read stored notification emails exposing customer PII, exploit requires authenticated Subscriber-level user. i...

Rogue-MySql-Server

Rogue-MySql-Server Edit script and change file to read and server port if you want. Run script and connect to your server for read file from client side. Read mysql.log for readed file content...

Slack Morphism verifier errors disclose valid HMACs in the logs

Summary Slack Morphism exposes the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp and request body and stores it in SlackEventWrongSignatureError.generatedhash. The error's...

CVE-2026-113799 Slack Morphism verifier errors disclose valid HMACs in the logs

Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp...

CVE-2026-113799 Slack Morphism verifier errors disclose valid HMACs in the logs

Slack Morphism is a client library for Slack Web/Events API/Socket Mode and Block Kit. Versions 1.0.0 through 2.27.0 expose the correct Slack request HMAC when signature verification fails. For an invalid request, slack-morphism computes the correct signature for the attacker-controlled timestamp...

CVE-2026-113799

The Slack Morphism client library (versions 1.0.0 through 2.27.0 ) contains a vulnerability where signature verification failures disclose valid HMACs in application logs. Specifically, the slack-morphism library computes the correct signature for an attacker-controlled request body and stores it...

CVE-2026-107319

The GamiPress WordPress plugin before version 8.0.6 is vulnerable to an activity log disclosure due to a missing capability check and ownership verification on an authenticated AJAX action . This flaw allows any authenticated user, such as a Subscriber , to read arbitrary entries from the activit...

WordPress GamiPress plugin < 8.0.6 - Subscriber+ Activity Log Disclosure vulnerability

Subscriber+ Activity Log Disclosure vulnerability discovered by Shirshak in WordPress Plugin GamiPress versions 8.0.6...

CVE-2026-92990 SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded Token

The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses...

CVE-2026-92990

The SendPress Newsletters WordPress plugin affects versions through 1.26.1.20 . The vulnerability stems from a hardcoded token used to protect a logging endpoint, which is identical across all site installations instead of being a unique per-site secret. This flaw allows unauthenticated users to ...

WordPress SendPress Newsletters plugin <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure vulnerability

Unauthenticated Newsletter Sending Log Disclosure vulnerability discovered by Usama Arshad in WordPress Plugin SendPress Newsletters versions = 1.26.1.20...

CVE-2026-92990 SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded Token

The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses...

PT-2026-104440

Name of the Vulnerable Software and Affected Versions postgresql-operator charm versions prior to 1189 arm64 and 1190 amd64 in the dev track 14/edge postgresql-operator charm versions prior to 1216 arm64 and 1217 amd64 in the stable track 14/stable Description The postgresql-operator charm utiliz...

CVE-2026-89004 WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execution logs of campaigns created by othe...

CVE-2026-89004

The WPeMatico RSS Feed Fetcher WordPress plugin, in versions before 2.8.26 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists because the plugin fails to verify ownership or authorization before returning a campaign's stored configuration and run logs. Consequently, u...

WordPress WPeMatico RSS Feed Fetcher plugin < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure vulnerability

Contributor+ Campaign Configuration and Log Disclosure vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin WPeMatico RSS Feed Fetcher versions 2.8.26...

GHSA-G26X-M427-F48F Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Summary The GET /api/v1/stable/durable-tasks/durable-task endpoint listDurableEventLog is missing tenant authorization validation, allowing any authenticated user to read durable task event logs from any tenant. Impact This CVE requires the attacker to successfully guess the target UUID. Any...

EUVD-2026-82436

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyterserver/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the...

CVE-2026-82723

AshAuthentication (the Elixir authentication library by team-alembic) stores full actor records—including the hashed_password attribute—into audit log entries via the audit_log add-on's build_extra_data/4 function. The :actor value from the action callback context is deposited verbatim, bypassing...

EUVD-2026-81476

Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store. The auditlog add-on builds each entry's extradata in AshAuthentication.AddOn.AuditLog.Auditor.buildextradata/4, which takes...