28889 matches found
WordPress WooCommerce PDF Invoice Builder plugin <= 2.0.8 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WooCommerce PDF Invoice Builder versions = 2.0.8...
CVE-2026-6280
Exposure of sensitive information due to incompatible policies vulnerability in NOMYSOFT Informatics Education and Consulting Inc. Nomysem allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Nomysem: through 08072026. NOTE: The vendor was contacted early about this...
CVE-2026-6280
Exposure of sensitive information due to incompatible policies vulnerability in NOMYSOFT Informatics Education and Consulting Inc. Nomysem allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Nomysem: through 08072026. NOTE: The vendor was contacted early about this...
EUVD-2026-42209
Exposure of sensitive information due to incompatible policies vulnerability in NOMYSOFT Informatics Education and Consulting Inc. Nomysem allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Nomysem: through 08072026. NOTE: The vendor was contacted early about this...
CVE-2026-6280 Improper Access Control in Nomysoft Informatics' Nomysem
Exposure of sensitive information due to incompatible policies vulnerability in NOMYSOFT Informatics Education and Consulting Inc. Nomysem allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Nomysem: through 08072026. NOTE: The vendor was contacted early about this...
CVE-2026-56139
A flaw was found in the Apache Camel Undertow component. The camel-undertow HTTP server consumer, when processing errors, could return full Java stack traces in HTTP responses. This occurs because the muteException option, which controls what is returned to the client during errors, defaulted to...
CVE-2026-14647
A flaw was found in onnx. This vulnerability, located in the convPoolShapeInferenceopset19 function of the onnxruntime component, allows a remote attacker to perform an out-of-bounds read. This could lead to the disclosure of sensitive information. Mitigation Mitigation for this issue is either n...
EUVD-2026-42158
An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and the GetAccessTokenComponent.java component...
CVE-2026-50813
An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path...
PT-2026-56526
Name of the Vulnerable Software and Affected Versions SQLite versions prior to Fossil check-in 869a51ae84df Description A local attacker can obtain sensitive information through the Session Extension changeset concat/changegroup merge path. Recommendations Update to Fossil check-in 869a51ae84df o...
Use of Cache Containing Sensitive Information
Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the UpdateCacheMiddleware and cachepage process when responses that vary on...
PYSEC-2026-1211 BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform. NOTE: The maintainers of BackendAI do not consider this report to fit with their threat model and advise users to follow security advice from...
GO-2026-5893 Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calicoctl
Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calicoctl. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
GO-2026-5888 Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico
Calico Inserts Sensitive Information into Log File in github.com/projectcalico/calico. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanner...
SUSE-SU-2026:2783-1 Security update for kubevirt-1.6
This update for kubevirt-1.6 fixes the following issues: - CVE-2026-9804: Symlink escape in the VMExport dir handler let an attacker controlling an exported PVC read sensitive files TLS keys, tokens, service-account creds from the exporter pod. bsc1266733 - CVE-2025-14525: A VM reporting many...
PYSEC-2026-1390 Frappe has possibility of SQL injection due to improper validations
Impact An SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Workarounds Upgrading is required, no other workaround is present. Credits Thanks to Thanh of Calif.io for reporting the issue...
PYSEC-2026-1800 Prefect CORS (Cross-Origin Resource Sharing) misconfiguration
A CORS Cross-Origin Resource Sharing misconfiguration in prefecthq/prefect prior to version 3.0.3 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruptio...
PYSEC-2026-1533 Letta (previously MemGPT) incorrect access control vulnerability
Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data...
PYSEC-2026-1459 Indico Insecure Access
A Broken Object Level Authorization BOLA vulnerability in Indico v3.2.9 allows attackers to access sensitive information via sending a crafted POST request to the component /api/principals...
