330295 matches found
CVE-2026-78602: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Elastic Maps Server can lead to information disclosure via Path Traversal CAPEC-126. An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside...
CVE-2026-19251: Exposure of Sensitive Information to an Unauthorized Actor
The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to is private, before returning profile activity to unauthenticated visitors, allowing them to read the content of comments still awaiting moderation...
CVE-2026-78601: Missing Authorization
Missing Authorization CWE-862 in Kibana can lead to information disclosure via Privilege Abuse CAPEC-122. An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly cause a background task...
CVE-2026-78584: Observable Response Discrepancy
Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...
CVE-2026-84485: Missing Authentication for Critical Function
APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated attackers to retrieve member names, email addresses, and team hierarchy. Attackers can query the endpoint with space identifiers obtained from shared links or...
PT-2026-84618
The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts...
PT-2026-84729
Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for Information CAPEC-54. An authenticated user holding Osquery live-query privileges could determine whether a scheduled query identifier exists in a Kibana space they are no...
PT-2026-84617
The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build publicly generated SEO metadata, allowing unauthenticated users to read the content of password-protected posts...
CVE-2026-84359
Information leak in Skia in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...
PT-2026-84629
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations...
CVE-2026-81195: Exposure of Sensitive Information to an Unauthorized Actor
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user...
Oracle Access Manager Webgate Information Disclosure (April 2026 CPU)
Binary data oracleaccessmanagerwebgatecve20250725.nbin...
The vulnerability of the SVG component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.
The vulnerability of the SVG component in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying the source of the data. Exploiting this vulnerability can allow an attacker to access confidential data through a specially created HTML page...
The vulnerability of the StorageAccessAPI component in Google Chrome and Microsoft Edge web browsers allows a hacker to gain access to confidential data.
The vulnerability of the StorageAccessAPI component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...
The vulnerability of Chromecast web browsers Google Chrome and Microsoft Edge allows a hacker to gain access to confidential data.
The vulnerability of Chromecast web browsers Google Chrome and Microsoft Edge relates to reading data beyond the allowed buffer size. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data...
The vulnerability of the Codecs components in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.
The vulnerability of the Codecs components in Google Chrome and Microsoft Edge relates to reading data from buffer registers beyond their allowable limits. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge web browsers allows a perpetrator to access confidential data.
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...
The vulnerability of the Password component in Google Chrome and Microsoft Edge web browsers allows attackers to gain access to confidential data.
The vulnerability of the Password component in Google Chrome and Microsoft Edge is related to a lack of data security mechanisms. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to confidential data through a specially created HTML page...
The vulnerability of the Views component in Google Chrome and Microsoft Edge browsers allows a hacker to gain access to confidential data.
The vulnerability of the Views component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data...
The vulnerability of the Enterprise web browsers Google Chrome and Microsoft Edge allows a perpetrator to access confidential data.
The vulnerability of the Enterprise web browsers Google Chrome and Microsoft Edge involves the disclosure of information due to incompatibility. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...