EUVD-2023-41412

A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals...

CVE-2026-1060

The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permissioncallback set to returntrue, allowing unauthenticated attacke...

CVE-2026-1060

CVE-2026-1060 concerns the WordPress plugin WP Adminify. The vulnerability allows unauthenticated access to sensitive addon information via the REST endpoint /wp-json/adminify/v1/get-addons-list. The endpoint is registered with a permisssion_callback of __return_true, enabling any user to retriev...

CVE-2026-0832

CVE-2026-0832 concerns the WordPress plugin New User Approve. The vulnerability arises from a missing capability check on multiple REST API endpoints, affecting all versions up to and including 3.2.2. This allows unauthenticated attackers to approve or deny user accounts, access sensitive user da...

CVE-2023-37525: Exposure of Sensitive System Information to an Unauthorized Control Sphere

A sensitive information disclosure in HCL BigFix Compliance allows a remote attacker to access files under the WEB-INF directory, which may contain Java class files and configuration information, leading to unauthorized access to application internals...

PT-2026-5197

Name of the Vulnerable Software and Affected Versions HCL BigFix Compliance affected versions not specified Description A flaw exists in HCL BigFix Compliance that allows a remote attacker to access files within the WEB-INF directory. These files may include Java class files and configuration...

CVE-2026-1060: Exposure of Sensitive Information to an Unauthorized Actor

The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permissioncallback set to returntrue, allowing unauthenticated attacke...

PT-2026-5125

The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.7.7 via the /wp-json/adminify/v1/get-addons-list REST API endpoint. The endpoint is registered with permission callback set to return true, allowing unauthenticated...

CVE-2025-65264

The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attacker to access sensitive information via a crafted request...

CVE-2026-24870

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3...

EUVD-2026-4728

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3...

CVE-2026-24870 Information disclosure in ixray-1.6-stcop

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3...

CVE-2025-69820

Directory Traversal vulnerability in Beam beta9 v.0.1.521 allows a remote attacker to obtain sensitive information via the joinCleanPath function...

CVE-2026-24477: Insertion of Sensitive Information Into Sent Data

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be exposed in plain text to unauthenticate...

CVE-2025-65264

The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attacker to access sensitive information via a crafted request...

PT-2026-4959

Name of the Vulnerable Software and Affected Versions ixray-team ixray-1.6-stcop versions prior to 1.3 Description A flaw exists that can lead to the exposure of sensitive information to an unauthorized actor. Recommendations Update ixray-team ixray-1.6-stcop to version 1.3 or later...

CVE-2026-24870: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ixray-team ixray-1.6-stcop.This issue affects ixray-1.6-stcop: before 1.3...

CVE-2025-65264

The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attacker to access sensitive information via a crafted request...

PT-2026-5080

Name of the Vulnerable Software and Affected Versions VidShop – Shoppable Videos for WooCommerce plugin for WordPress versions up to and including 1.1.4 Description The VidShop – Shoppable Videos for WooCommerce plugin for WordPress is susceptible to time-based SQL Injection. This is due to...

CVE-2025-11065

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...