22296 matches found
WordPress plugin “Restaurant Menu” by MotoPress has security vulnerabilities
WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An information disclosure vulnerability exists in the WordPress plugin Restaurant Menu by...
Kentico Xperience security vulnerabilities
Kentico Xperience is a digital experience platform from Kentico. Kentico Xperience has a security vulnerability that can be exploited by an attacker to cause sensitive information to be exposed to an external domain...
PT-2025-52205
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs WP ERP erp allows Retrieve Embedded Sensitive Data.This issue affects WP ERP: from n/a through = 1.16.6...
PT-2025-52181
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Retrieve Embedded Sensitive Data.This issue affects Email marketing for WordPress by GetResponse Official: from...
WordPress plugin Ultimate Member Widgets for Elementor has a security vulnerability
WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An information disclosure vulnerability exists in the WordPress plugin Ultimate Member Widgets...
Utarit SoliClub security vulnerability
Utarit SoliClub is a mobile application from Utarit, Inc. A security vulnerability exists in Utarit SoliClub versions prior to 5.3.7, which stems from the disclosure of private personal information and may result in the querying of system information...
CVE-2025-63390
An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fails to implement proper authentication checks, allowing unauthenticated remote attackers to enumerate and retrieve detailed information about all configured workspaces. Exposed...
Kroki security vulnerabilities
kroki is an open source icon creation tool from Yuzu tech. A security vulnerability exists in kroki, which stems from an insufficient cleanup of the convert function, which could result in sending requests to arbitrary URLs and disclosing sensitive information...
Mattermost Desktop App exposes sensitive information in its application logs
Mattermost Desktop App versions 6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker with access to the users system to gain access to potentially sensitive information via reading the application logs. A fix is available for...
CVE-2025-43475
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2. An app may be able to access user-sensitive data...
USN-7940-1: Linux kernel (Azure FIPS) vulnerabilities
Jean-Claude Graf, Sandro Rüegge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation between a guest and a userspace hypervisor for certain processors. This flaw is known as VMSCAPE. An attacker in a guest VM could possibly use this t...
CVE-2025-43475
CVE-2025-43475 concerns Apple iOS and iPadOS logging. The affected software includes iOS and iPadOS prior to version 26.2. The root cause is a logging issue where sensitive data could be exposed due to insufficient redaction. The practical impact is that an app may access user‑sensitive data via ...
CVE-2025-34441 AVideo < 20.1 User Information Disclosure via Public API
AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations...
CVE-2025-34441 AVideo < 20.1 User Information Disclosure via Public API
AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations...
CVE-2025-34441 AVideo < 20.1 User Information Disclosure via Public API
AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations...
CVE-2025-34441
AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations...
CVE-2025-13321
CVE-2025-13321 affects Mattermost Desktop App versions prior to 6.0.0. The vulnerability stems from failure to sanitize sensitive information in application logs and to purge data on server deletion, enabling an attacker with local access to read potentially sensitive information from logs. Evide...
CVE-2025-10450
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in RTI Connext Professional Core Libraries allows Sniffing Network Traffic.This issue affects Connext Professional: from 7.4.0 before 7., from 7.2.0 before 7.3.1...
Improper Path Handling
formio is vulnerable to improper path handling. The vulnerability is due to improper validation of crafted request paths, which allows an unauthenticated or unauthorized attacker to bypass API access controls and retrieve data from protected endpoints...