954 matches found
EUVD-2026-102858
Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1...
CVE-2026-111719: Missing Authentication for Critical Function
Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain th...
PT-2026-115594
Name of the Vulnerable Software and Affected Versions MapSVG versions prior to 8.16.2 Description A missing authorization issue in the mapsvg-lite-interactive-vector-maps component allows the retrieval of embedded sensitive data. Recommendations Update to a version newer than 8.16.1...
CVE-2026-111397: Missing Authorization
Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sensitive Data.This issue affects MapSVG: from n/a through 8.16.1...
CVE-2026-105039
EnergizeLab station-middleware (NestJS) Docker images versions 1.6.5 through 1.8.2 are vulnerable to a Missing Authorization (CWE-862) flaw. The application fails to perform role checks on administrative APIs, allowing any authenticated low-privilege user to perform unauthorized actions. Attacker...
CVE-2026-105039 EnergizeLab Station Middleware Admin APIs Missing Role Checks
EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents...
CVE-2026-110361
Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1...
CVE-2026-45165 Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access...
EUVD-2026-102300
An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch. Under specific circumstances, an attacker could potentially leverage this to retrieve unauthorized secrets, alter administrative access...
CVE-2026-110361
The WordPress Infinite Uploads plugin (versions
CVE-2026-110361 WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1...
CVE-2026-109695
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1...
CVE-2026-109695
The WPManageNinja FluentCart plugin (versions
CVE-2026-109695 WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1...
CVE-2026-109695: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affects FluentCart: from n/a through 1.7.1...
CVE-2026-110361: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects Infinite Uploads: from n/a through 3.4.1...
CVE-2026-87843: Improper Access Control
The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns from the hosted payment page, nor bind that response to the targeted order or check the amount, allowing unauthenticated attackers t...
CVE-2026-106598
The ThemeGrill User Registration WordPress plugin (versions n/a through 5.2.8 ) is vulnerable to a Missing Authorization vulnerability. This flaw allows an attacker to Retrieve Embedded Sensitive Data . No specific technical root cause, exploit details, or remediation steps are provided in the do...
CVE-2026-108489
The Active Products Tables for WooCommerce plugin (by PluginUs.Net) versions up to and including 2.1.3 is vulnerable to an Insertion of Sensitive Information Into Sent Data vulnerability (CWE-201). This flaw allows for the retrieval of embedded sensitive data from the application. No specific rem...