CVE-2025-62310

Technical details about CVE-2025-62310 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories; no specifics on affected versions, vectors, or mitigations are available here.

CVE-2026-4031

The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2. This is due to the plugin not restricting access to the wpdbtempdir parameter, which controls where database backups are written. This makes it possible for...

WS-2020-0161

A Sensitive Data Exposure was found in renovate before 23.25.1, Applies to Azure DevOps users only. The bot's token may be exposed in server or pipeline logs due to the http.extraheader=AUTHORIZATION parameter being logged without redaction. It is recommended that Azure DevOps users revoke their...

WS-2020-0010

All versions of simple-crypto-js use AES-CBC with PKCS7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data...

WS-2019-0287

Ibmdb before 2.6.0 is vulnerable to Sensitive Data Exposure. The package printed database credentials in plaintext in logs while in debug mode...

WS-2019-0247

In loopback, versions before v2.42.0 2.x and before v3.26.0 3.x are vulnerable to sensitive data exposure when Invalid API requests to the login endpoint may return information about the first user in the database...

WS-2018-0204

Versions of pem before 1.13.2 expose sensitive data when the readPkcs12 is used...

WS-2019-0057

All versions of sequelize-cli are vulnerable to Sensitive Data Exposure. The function filteredURL does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text...

WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peng Zhou in WordPress Plugin Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity versions = 3.3.6...

CVE-2026-28962

This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may disclose sensitive user information...

CVE-2026-28958

A flaw was found in WebKitGTK. Processing or loading malicious web content can allow an app to access sensitive user data due to improper data protection. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require...

EUVD-2026-30207

Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information CWE-319 vulnerability. A man-in-the-middle attacker may access and modify communications transmitted in plaintext, potentially resulting in information disclosure or data tampering...

WS-2018-0147

All versions of put are vulnerable to Uninitialized Memory Exposure. The package incorrectly calculates the allocated Buffer size and does not trim the bytes written, which may allow attackers to access uninitialized memory containing sensitive data. This vulnerability only affects versions of...

PT-2026-40954

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description Backend service details may be transmitted over insecure HTTP channels, which can expose sensitive information to potential interception or unauthorized access during transmission under...

PT-2026-40952

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description The auto-complete functionality is enabled for certain input fields, which may allow sensitive information to be stored in the browser. This could lead to unintended exposure of data under...

PT-2026-40950

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description Certain operations may trigger out-of-band interactions, which are communication channels that occur outside the primary data stream. This behavior can lead to the unintended disclosure of...

PT-2026-41149

Name of the Vulnerable Software and Affected Versions dbt-mcp versions prior to 1.17.1 Description dbt-mcp is a Model Context Protocol server for interacting with dbt. The DbtMCP.call tool function in src/dbt mcp/mcp/server.py logs the raw arguments dictionary at the INFO level before every tool...

PT-2026-40958

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description Sensitive information may be included in URL parameters. Passing sensitive data in URLs can expose it through browser history, logs, or intermediary systems, potentially leading to unintende...

HCL AION security vulnerabilities

HCL AION is an AI lifecycle management platform developed by the Indian company HCL. HCL AION has a security vulnerability, which stems from the use of autocompletion features for certain input fields. This may lead to sensitive information being stored in the browser, potentially causing...

WordPress Plugin Database Backup: Security Vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...