WS-2018-0204

Versions of pem before 1.13.2 expose sensitive data when the readPkcs12 is used...

WS-2019-0057

All versions of sequelize-cli are vulnerable to Sensitive Data Exposure. The function filteredURL does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text...

WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peng Zhou in WordPress Plugin Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity versions = 3.3.6...

CVE-2026-28962

This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may disclose sensitive user information...

CVE-2026-28958

A flaw was found in WebKitGTK. Processing or loading malicious web content can allow an app to access sensitive user data due to improper data protection. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require...

EUVD-2026-30207

Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information CWE-319 vulnerability. A man-in-the-middle attacker may access and modify communications transmitted in plaintext, potentially resulting in information disclosure or data tampering...

WS-2018-0147

All versions of put are vulnerable to Uninitialized Memory Exposure. The package incorrectly calculates the allocated Buffer size and does not trim the bytes written, which may allow attackers to access uninitialized memory containing sensitive data. This vulnerability only affects versions of...

PT-2026-40954

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description Backend service details may be transmitted over insecure HTTP channels, which can expose sensitive information to potential interception or unauthorized access during transmission under...

PT-2026-40952

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description The auto-complete functionality is enabled for certain input fields, which may allow sensitive information to be stored in the browser. This could lead to unintended exposure of data under...

PT-2026-40950

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description Certain operations may trigger out-of-band interactions, which are communication channels that occur outside the primary data stream. This behavior can lead to the unintended disclosure of...

PT-2026-40958

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description Sensitive information may be included in URL parameters. Passing sensitive data in URLs can expose it through browser history, logs, or intermediary systems, potentially leading to unintende...

WordPress Plugin Database Backup: Security Vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

HCL AION security vulnerabilities

HCL AION is an AI lifecycle management platform developed by the Indian company HCL. HCL AION has a security vulnerability, which stems from the possibility of sensitive information being included in URL parameters, potentially leading to leaks through browser history, logs, or intermediate syste...

Fleet Trust Management Vulnerabilities

Fleet is an open-source device management platform developed by Fleet Device Management. It supports various operating systems and devices, and helps IT and security teams with device management, vulnerability reporting, and MDM operations. Versions of Fleet prior to 4.81.0 contained a trust...

HCL AION security vulnerabilities

HCL AION is an AI lifecycle management platform developed by the Indian company HCL. HCL AION has a security vulnerability; this vulnerability stems from the possibility of sensitive information being transmitted through insecure HTTP channels during backend services, which could lead to the...

Microsoft Authenticator information leakage vulnerability

Microsoft Authenticator is an application for multi-factor authentication developed by Microsoft Corporation in the United States. There is an information leakage vulnerability in Microsoft Authenticator. This vulnerability stems from the exposure of sensitive information to unauthorized...

HCL AION security vulnerabilities

HCL AION is an AI lifecycle management platform developed by the Indian company HCL. HCL AION has a security vulnerability, which stems from the use of autocompletion features for certain input fields. This may lead to sensitive information being stored in the browser, potentially causing...

PT-2026-41149

Name of the Vulnerable Software and Affected Versions dbt-mcp versions prior to 1.17.1 Description dbt-mcp is a Model Context Protocol server for interacting with dbt. The DbtMCP.call tool function in src/dbt mcp/mcp/server.py logs the raw arguments dictionary at the INFO level before every tool...

CVE-2026-38740

Foscam VD1 Video Doorbell before V5.3.131072 is vulnerable to Cleartext Transmission of Sensitive Information. The device transmits sensitive Session Description Protocol SDP, including ICE credentials and candidates, in cleartext over network interfaces. An attacker with network visibility can...

CVE-2026-23998: Improper Certificate Validation

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to impersonate an enrolled...