XWiki < 4.10.15 - Email Disclosure

The Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for objcontent:email using XWiki's regular search interface. id: CVE-2023-50720 info: name: XWiki 4.10.15 - Email Disclosure author:...

PrismaWEB - Credentials Disclosure

PrismaWEB is susceptible to credential disclosure. The vulnerability exists due to the disclosure of hard-coded credentials allowing an attacker to effectively bypass authentication of PrismaWEB with administrator privileges. The credentials can be disclosed by simply navigating to the loginpar.j...

CVE-2026-44108

Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticated remote attacker to connect to these...

CVE-2026-44108

CVE-2026-44108 describes a flaw in the shutdown script execution order that terminates the firewall during shutdown, creating a temporary window where internal services may become externally accessible. This could allow an unauthenticated remote attacker to connect to those services and potential...

EUVD-2026-51042

A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service attack...

CVE-2026-44105

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted...

CVE-2026-44105

The CVE-2026-44105 entry describes that credentials for the local user “user-app” may be exposed in log files, potentially allowing a low-privileged local attacker with log access to authenticate via SSH as user-app. The available metrics indicate LOCAL attack vector, low user interaction, with a...

EUVD-2026-51041

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted...

CVE-2026-44090

Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised...

CVE-2026-44090

CVE-2026-44090 describes a lack of authentication exposing an MQTT broker to unauthenticated remote access. The broker is only protected by an external firewall, enabling a network attacker to potentially take full control of the device. Documented impact includes high confidentiality, integrity,...

CVE-2026-59327

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

CVE-2026-15235

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account Subscriber and above to read the personal data, including name...

CVE-2026-14223

The Easy Appointments WordPress plugin through 3.12.26 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...

CVE-2026-13345

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce products in its product-comparison feature, allowing unauthenticated users to disclose the title, price, and SKU of draft, pending, and private...

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

CVE-2026-1360

creationtimestamp| type| source ---|---|--- 2026-07-30 06:00:43+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mrtr7gmx3j2c...

CVE-2026-13145

The CVE covers WP Travel for WordPress, pre-11.8.1. Affected: WP Travel WordPress plugin before 11.8.1. Issue: reading another user’s booking details (including billing address) via an IDOR on the customer account dashboard because the plugin does not verify that the requested booking belongs to ...

CVE-2026-13145 WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking...

EUVD-2026-50999

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

CVE-2026-14231

The CVE refers to the LifterLMS WordPress plugin prior to version 10.0.10, where one of the select2 query AJAX handlers does not perform a proper capability check beyond ensuring the user is logged in. This allows any authenticated user with subscriber-level access to read titles of internal post...