Akkadian Provisioning Manager 4.50.02 - Sensitive Information Disclosure

Akkadian Provisioning Manager 4.50.02 could allow viewing of sensitive information within the /pme subdirectories. id: CVE-2020-27361 info: name: Akkadian Provisioning Manager 4.50.02 - Sensitive Information Disclosure author: gy741 severity: high description: Akkadian Provisioning Manager 4.50.0...

rConfig <3.9.4 - Sensitive Information Disclosure

rConfig prior to version 3.9.4 is susceptible to sensitive information disclosure. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application does not exit after a redirect is applied, the rest of the page still executes,...

Adobe Experience Manager - Expression Language Injection

Adobe Experience Manager versions 6.5, 6.4, 6.3, 6.2, 6.1, and 6.0 has an expression language injection vulnerability. id: CVE-2019-16469 info: name: Adobe Experience Manager - Expression Language Injection author: DomenicoVeneziano severity: high description: | Adobe Experience Manager versions...

WordPress Modern Events Calendar Lite <5.16.5 - Sensitive Information Disclosure

WordPress Modern Events Calendar Lite before 5.16.5 does not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format. id: CVE-2021-24146 info: name: WordPress Modern Events Calendar Lite 5.16.5 - Sensitive Information Disclosure...

Cuppa CMS v1.0 - Local File Inclusion

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php. id: CVE-2022-25486 info: name: Cuppa CMS v1.0 - Local File Inclusion author: theamanrawat severity: high description: | CuppaCMS v1.0 was discovered to contain a local file...

CVE-2021-43798-grafana_fileread

CVE-2021-43798-grafanafileread If the target is behind a reverse proxy, replace the payload with this one: url1 = url +"/public/plugins/"+str.rstripplugins+"//../..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/etc/passwd" Grafana is a cross-platform, open-source data visualization web application...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure vulnerability

Unauthenticated Sensitive Information Disclosure vulnerability discovered by Jiří Fryjauf jfryjauf in WordPress Plugin LatePoint versions = 5.7.4...

CVE-2026-109382

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wspgetposts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate method accepts any...

EUVD-2026-102794

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wspgetposts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate method accepts any...

CVE-2026-109382 WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5. This is due to the wspgetposts MCP tool being registered with an empty capability requirement while the MCP endpoint's authenticate method accepts any...

CVE-2026-109382

The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to and including 2.9.5 . The flaw stems from broken access control where the wsp_get_posts MCP tool is registered with an empty capability requirement, and the authenticate() meth...

CVE-2026-107746

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to an authorization bypass in versions up to and including 3.16.0.6 . The root cause is a failure to properly verify user authorization when processing specific parameters, allowing unauthenticated attacker...

EUVD-2026-102303

Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1...

WordPress WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents plugin <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Wordfence PRISM in WordPress Plugin WSP MCP AI Agents Connector versions = 2.9.5...

WordPress FunnelKit – Funnel Builder Plugin for WooCommerce Checkout plugin <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Disclosure vulnerability discovered by Kuba in WordPress Plugin Funnel Builder by FunnelKit versions = 3.16.0.6...

CVE-2026-75559

The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted by the application, potentially leading to the exposure of API integration credentials such as an access ID and access key...

CVE-2026-110868

A flaw was found in Renovate. A Server-Side Request Forgery SSRF vulnerability allows an attacker to coerce the shared HTTP client into sending requests to arbitrary internal network addresses through crafted presets or custom data sources. This issue primarily leads to sensitive information...

CVE-2026-96540

An improper access control vulnerability has been identified in the SonicWall Network Security Manager NSM on-prem in export settings, potentially allowing a remote authenticated attacker to obtain sensitive information. This may allow the attacker to escalate privileges to an administrator or to...

BIT-KIBANA-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure

Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...

BIT-ELK-2026-102412 Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure

Incorrect Authorization CWE-863 in Kibana can lead to sensitive information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated Kibana user with limited Fleet management privileges could access sensitive credential material that should be restricted t...