EUVD-2026-55102

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21077

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21076

Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21076

Samsung Health prior to version 7.0.0 has an incorrect authorization flaw that could allow local attackers to access sensitive information. Affected product: Samsung Health (pre-7.0.0). Root cause: improper access control enabling local access to data. Reported CVSS v4.0 base score 6.9 (MEDIUM) w...

EUVD-2026-55095

Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information...

CVE-2026-21070

Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information...

WordPress iCARRY plugin <= 2.9 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Legion Hunter in WordPress Plugin iCARRY versions = 2.9...

WordPress WooCommerce Appointments plugin <= 5.3.8 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by adhikara13 in WordPress Plugin WooCommerce Appointments versions = 5.3.8...

CVE-2026-19074

The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...

CVE-2026-19074

The Advanced Classifieds & Directory Pro WordPress plugin (versions prior to 3.4.3 ) is vulnerable to unauthenticated sensitive information exposure. This issue occurs via the AJAX action acadp_public_custom_fields_listings, which allows unauthorized actors to disclose non-public listing custom f...

CVE-2026-17542

The File Manager WordPress plugin (versions before 6.9.1 ) contains a vulnerability in the bitapps_fm_connector endpoint. Due to a missing capability check , any authenticated user, such as a subscriber , can browse the entire WordPress installation directory. This allows attackers to download sp...

CVE-2026-17542 Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector

The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including...

PT-2026-69411

Name of the Vulnerable Software and Affected Versions Smart Switch versions prior to 3.7.72.6 Description Improper input validation allows adjacent attackers to access sensitive data. Recommendations Update to version 3.7.72.6 or later...

PT-2026-69836

Name of the Vulnerable Software and Affected Versions Zyxel Networks WAH7601 versions through 20072026 Description An insufficiently protected credentials issue allows the retrieval of embedded sensitive data. Recommendations At the moment, there is no information about a newer version that...

PT-2026-69976

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.109.0 ERPNext versions prior to 16.20.0 Description An authenticated low-privilege user can perform SQL injection to extract sensitive information. This occurs because the get tax template function in...

CVE-2026-21083: Improper Input Validation

Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...

CVE-2026-12984: Insufficiently Protected Credentials

Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026...

CVE-2026-18032 WP Data Access < 5.5.79 - Unauthenticated Sensitive Data Disclosure via Autocomplete Column Authorization Bypass

The WP Data Access WordPress plugin before 5.5.79 does not validate the column names it accepts on one of its unauthenticated AJAX actions, and the nonce guarding that action does not cover them, allowing unauthenticated attackers to read arbitrary columns of the database table the affected...

Sensitive Info Goes Into ‘No Reply’ Emails Constantly. This Guy Sees It All

Two security researchers bought cheap domains—including noreply.net and deleteduser.com—and set up email listening services. Hundreds of companies are sending them corporate secrets...

EUVD-2026-54740

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the WP Directory Kit WordPress plugin before 1.5.5 settings including sensitive API keys and...