19955 matches found
CVE-2026-20932
CVE-2026-20932 is a Windows File Explorer information disclosure vulnerability with local access as the attack vector and a CVSS v3.1 base score of 5.5 (Medium). The connected advisories indicate the issue exists in Windows File Explorer and that Microsoft released January 2026 security updates; ...
CVE-2026-20827
Exposure of sensitive information to an unauthorized actor in Tablet Windows User Interface TWINUI Subsystem allows an authorized attacker to disclose information locally...
CVE-2025-14507 EventPrime - Events Calendar, Bookings and Tickets <= 4.2.7.0 - Unauthenticated Sensitive Information Exposure via REST API
The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive booking data including user names,...
PT-2026-2735
CVE-2026-20932 Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. https://t.co/J6pzkoy0sZ...
Security Updates for Microsoft SharePoint Server 2019 (January 2026)
The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...
Microsoft Desktop Windows Manager 安全漏洞
Microsoft Desktop Windows Manager is a desktop window manager from Microsoft Corporation USA. A security vulnerability exists in Microsoft Desktop Windows Manager. An attacker exploiting this vulnerability could gain access to sensitive information. The following products and versions are...
Microsoft Windows Kernel 日志信息泄露漏洞
Microsoft Windows Kernel is the kernel of the Windows operating system from Microsoft Corporation USA. A log information disclosure vulnerability exists in Microsoft Windows Kernel. An attacker exploiting this vulnerability could gain access to sensitive information. The following products and...
PT-2026-2470
A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticat...
CVE-2025-65784
Hubert Hub v2.0.1.27.3 (Hubert Imoveis e Administracao Ltda) has an insecure permissions issue that lets authenticated users with low privileges retrieve other users’ information through a crafted API request. Impact: confidentiality of data. Root cause: improper access controls on API endpoints....
PT-2026-2739
CVE-2026-20937 Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. https://t.co/7wV1JGOJF9...
CVE-2025-55462
A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. This permits malicious third-party websites to perform authenticat...
ROS-20260113-7368
A vulnerability in the mienumattr function in the fs/ntfs3/record.c module of the ntfs3 file system of the Linux kernel is related to privilege escalation. Exploitation of the vulnerability may allow an intruder to affect the confidentiality, integrity and availability of protected information...
CVE-2026-22788
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies,...
CVE-2026-22788
WebErpMesv2 (Resource Management/MES Web) before version 1.19 exposes multiple sensitive API endpoints without authentication. An unauthenticated remote attacker can read business-critical data (companies, quotes, orders, tasks, whiteboards) and have limited write access to create company records...
CVE-2026-22788 WebErpMesv2 allows unauthenticated API Access
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies,...
CVE-2026-22788 WebErpMesv2 allows unauthenticated API Access
WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2 application exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies,...
CVE-2025-46067
An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain sensitive information via a crafted js file...
CVE-2025-46067
An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain sensitive information via a crafted js file...
WordPress WooCommerce Square plugin <= 5.1.1 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure vulnerability
Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure vulnerability discovered by DityaRA in WordPress Plugin WooCommerce Square versions = 5.1.1...
CVE-2026-0853 A-Plus Video Technologies｜NVR - Sensitive Data Exposure
Certain NVR models developed by A-Plus Video Technologies has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access the debug page and obtain device status information...