EUVD-2026-49217

Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking = 1.0.0 versions...

CVE-2026-59548

The CVE concerns WordPress Byteflows Travel & Hotel Booking plugin, version

EUVD-2026-49205

Unauthenticated Sensitive Data Exposure in Ebook Store = 6.19 versions...

CVE-2026-59528

Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates = 1.1.1 versions...

CVE-2026-59528

CVE-2026-59528 concerns the WordPress plugin ShipTime: Discounted Shipping Rates (versions

CVE-2026-59529

The CVE-2026-59529 entry concerns the WordPress Ebook Store plugin versions ≤ 6.19 with an unauthenticated sensitive data exposure vulnerability. Provided details indicate an external attacker can access sensitive data without authentication (CVSS v3.1: 7.5 HIGH, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A...

CVE-2026-59528 WordPress ShipTime: Discounted Shipping Rates plugin <= 1.1.1 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates = 1.1.1 versions...

CVE-2026-59529 WordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in Ebook Store = 6.19 versions...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read through the thriftbufferedtransportreadslow and thriftframedtransportreadslow paths in the cglib transport bindings. An attacker can trigger the bug by sending a read request that spans both buffered data and new...

CVE-2026-9830

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

BIT-OPENBAO-2025-4166 Vault May Include Sensitive Data in Error Logs When Using the KV v2 Plugin

Vault Community and Vault Enterprise Key/Value kv Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is...

Siemens SIMATIC S7-1500 CPU 1518 MFP Exposure of Sensitive Information Due to Incompatible Policies (CVE-2025-39955)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505852; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Linux Distros Unpatched Vulnerability : CVE-2026-60315

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: X Plugin. Supported versions that are affected are MySQL Server:...

Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An...

PT-2026-64853

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

VulnCheck KEV: CVE-2025-68686

Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An...

Cache Confusion

Next.js is vulnerable to Cache Confusion. The vulnerability is due to improper caching of server-side fetch responses, where cached response bodies may be reused across requests with different request bodies, allowing confidential data from one request to be exposed to unauthorized users...

Sensitive Information Exposure

Next.js is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper caching of server-side fetch responses for non-UTF-8 request bodies, where different request bodies can share the same cache entry, allowing confidential response data to be exposed to unauthorized...

Linux Distros Unpatched Vulnerability : CVE-2026-16768

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds read can occ...

Budibase: Unauthenticated user information disclosure via public tenant user lookup endpoint

Summary The Budibase Worker service exposes a public, unauthenticated API endpoint GET /api/global/users/tenant/:id that returns sensitive user information including tenantId, userId, email, and ssoId. The endpoint is registered in the PUBLICENDPOINTS list with a TODO comment acknowledging it...