32377 matches found
WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Nabil Irawan in WordPress Plugin Pay with Contact Form 7 versions = 1.0.4...
CVE-2026-16616
The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to read arbitrary files on the server and to relocate critical files out of the web root, leading to sensitive information disclosure a...
EUVD-2026-62482
An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the apivedo/chat endpoint and the utentechat parameter...
CVE-2026-51367
An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the apivedo/chat endpoint and the utentechat parameter...
CVE-2026-73386: Insertion of Sensitive Information Into Sent Data
Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...
CVE-2026-73384: Insertion of Sensitive Information Into Sent Data
Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 = 1.0.4 versions...
PT-2026-78341
Name of the Vulnerable Software and Affected Versions Pay with Contact Form 7 versions prior to 1.0.5 Description An issue exists that allows unauthenticated users to cause sensitive data exposure. Recommendations Update to a version newer than 1.0.4...
PT-2026-78343
Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 = 3.0.2 versions...
EUVD-2026-61153
Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required adminpermission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting...
CVE-2026-66781 Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication
A flaw was found in the Submariner operator. The Submariner Custom Resource CR, used for configuring network connectivity, stores the IPsec pre-shared key PSK in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by...
CVE-2026-66781
A flaw was found in the Submariner operator. The Submariner Custom Resource CR, used for configuring network connectivity, stores the IPsec pre-shared key PSK in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by...
CVE-2026-74007
Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery = 1.16.20 versions...
CVE-2026-74008
Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embedded Sensitive Data.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.24...
CVE-2026-75485
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather...
CVE-2026-73834
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulti...
USN-8641-1: .NET vulnerabilities
Miha Zupan discovered that .NET did not properly interpret certain HTTP requests. An attacker could possibly use this issue to perform request smuggling and bypass a security feature. CVE-2026-62899 Ivan Demchuk discovered that .NET did not properly handle the removal of sensitive information...
GO-2026-6240 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api
New API: User List API Leaks Root User Access Token Leading to Privilege Escalation in github.com/QuantumNous/new-api...
CVE-2026-32468
Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...
CVE-2026-74008
The WordPress "Shortcodes and extra features for Phlox theme" plugin (auxin-elements) version 2.17.22 and earlier exposes sensitive data without authentication, rated CVSS 5.3 (MEDIUM). CISA SSVC shows no known exploitation. No patch version is mentioned in the provided documents; update to a new...