Insertion of Sensitive Information into Log File

Overview org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the reindex request due to redacting certain fields from the body of rest requests in audit logs. An attacker...

EUVD-2025-33697

A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser This issue affects AION: 2.0...

CVE-2025-52630 HCL AION is susceptible to Missing or insecure "X-Content-Type-Options" header vulnerability

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0...

CVE-2025-52634

HCL AION (AI lifecycle platform) 2.0 is affected by CVE-2025-52634, described as an information disclosure vulnerability enabling unauthorized access. Multiple sources (NVD, RHACVE, CNVD, CNNVD, CVE lists, PT-2025-41539) corroborate that sensitive information can be exposed to an unauthenticated ...

EUVD-2025-33690

Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics. v6.6 allows Loading third-party scripts without integrity checks or validation can allow external code run in the application's context, risking data exposure...

CVE-2025-52655

CVE-2025-52655 affects HCL MyXalytics 6.6. The flaw is inclusion of functionality from an untrusted control sphere, allowing loading of third‑party scripts without integrity checks or validation. This can cause external code to run in the application's context, risking data exposure. Exploitation...

CVE-2025-21050

Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles...

CVE-2025-21050

Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles...

WordPress WP Gmail SMTP plugin <= 1.0.7 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Legion Hunter in WordPress Plugin WP Gmail SMTP versions = 1.0.7...

CVE-2025-21061

Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access sensitive data. User interaction is required for triggering this vulnerability...

PT-2025-41535

Name of the Vulnerable Software and Affected Versions HCL MyXalytics version 6.6 Description The software contains a flaw related to the inclusion of functionality from an untrusted control sphere. Specifically, the application allows loading third-party scripts without proper integrity checks or...

PT-2025-41545

Name of the Vulnerable Software and Affected Versions HCL AION version 2.0 Description A security issue has been identified in HCL AION where cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser. Recommendations At the...

CVE-2025-52655: Inclusion of Functionality from Untrusted Control Sphere

Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics. v6.6 allows Loading third-party scripts without integrity checks or validation can allow external code run in the application's context, risking data exposure...

Fedora: Security Advisory (FEDORA-2025-acd3e11344)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-0fe3b1b7fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the io_futex_wait() function in the io_uring/futex.c module, a component of the Linux kernel’s asynchronous input/output interface, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the iofutexwait function in the iouring/futex.c module, a component of the Linux kernel’s asynchronous input/output interface, relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, a...

PT-2025-41565

Name of the Vulnerable Software and Affected Versions Aybs Interaktif versions 2024 through 28082025 Description The software exhibits flaws in permission management, potentially allowing unauthorized access to sensitive information and enabling privilege abuse and authentication bypass. This cou...

The vulnerability of the R9 platform for building automated systems lies in the storage of authentication data in unencrypted configuration files, allowing attackers to gain unauthorized access to the system.

The vulnerability of the R9 platform for building automation systems lies in the storage of authentication data in unencrypted configuration files. Exploiting this vulnerability could allow a perpetrator to gain unauthorized access to the system...

WordPress AppExperts plugin <= 1.4.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Legion Hunter in WordPress Plugin AppExperts versions = 1.4.5...

PT-2025-41410

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos Space versions prior to 24.1R3 Description A flaw exists in the web interface of Junos Space that could allow a network-based attacker with valid credentials to download arbitrary files from the file system. An attacker...