CVE-2026-87450

A flaw was found in Google Chrome. This incorrect authorization vulnerability in Permissions allows a remote attacker, by leveraging social engineering and a crafted Chrome extension, to obtain sensitive information. This could lead to the unauthorized disclosure of user data...

WordPress Visualizer plugin < 4.0.7 - Contributor+ Cross-User Chart Configuration Disclosure vulnerability

Contributor+ Cross-User Chart Configuration Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Visualizer versions 4.0.7...

PT-2026-72163

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...

Kibana 8.19.19 and 9.4.5 Security Update (ESA-2026-86)

Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated...

CVE-2026-16590 WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users...

CVE-2026-16590 WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure

The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users...

CVE-2026-16578 Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

CVE-2026-16578 Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, ema...

CVE-2026-21824

HCL Commerce contains an privilege escalation vulnerability that could allow denial of service, disclosure of user personal data, and performing of unauthorized administrative operations...

CVE-2026-34395

WWBN AVideo

CVE-2026-34395 AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged but does not check User::isAdmin...

CVE-2026-20675

A vulnerability exists in the ImageIO component of several Apple operating systems, including iOS , iPadOS , macOS , tvOS , visionOS , and watchOS . The root cause is a lack of sufficient bounds checks, which allows processing a maliciously crafted image to lead to the disclosure of user informat...

EUVD-2026-5579

DeepAudit is a multi-agent system for code vulnerability discovery. In 3.0.4 and earlier, there is an improper access control vulnerability in the /api/v1/users/ endpoint allows any authenticated user to enumerate all users in the system and retrieve sensitive information including email addresse...

BIT-MOODLE-2025-3625 Moodle: user dos and name disclosure via idor in moodle mfa email factor revoke action

A security vulnerability was discovered in Moodle that can allow hackers to gain access to sensitive information about students and prevent them from logging into their accounts, even after they had completed two-factor authentication 2FA...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 2024R1.1.2 that stems from the potential...

EUVD-2020-6428

Malware in sbrugna...

EUVD-2021-29605

Malicious code in bioql PyPI...

EUVD-2025-9320

Malicious code in bioql PyPI...

EUVD-2024-21071

Malicious code in bioql PyPI...

CVE-2025-41030 Multiple vulnerabilities in Deporsite by T-INNOVA

Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to obtain information from other users via GET ‘/ajax/TInnovav2/IntegrantesRecursov21/llamadaAjax/buscarPersona’ using the ‘dni’ parameter...