CVE-2026-65543

CVE-2026-65543 affects the WordPress Vimeo plugin (versions ≤ 1.2.2). The vulnerability is described as Subscriber Sensitive Data Exposure, with CVSS v3.1 Base Score 7.5 (HIGH) and an attack vector of NETWORK, requiring no privileges and no user interaction. The root cause and affected components...

CVE-2026-65543 WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

EUVD-2026-53973

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

CVE-2026-28169

CVE-2026-28169 concerns unauthenticated sensitive data exposure in the WordPress plugin YITH WooCommerce Zoom Magnifier (versions

WordPress Export Import Menus plugin <= 1.9.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Export Import Menus versions = 1.9.2...

WordPress Featured Video Plus plugin <= 2.3.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Featured Video Plus versions = 2.3.3...

EUVD-2026-53820

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...

rclone: Verbose Stack Trace Disclosure in RC API Error Responses

Summary When an RC API call triggers a panic recovered by the job runner, the full Go stack trace is included in the JSON error response. This leaks internal file paths, Go module versions, goroutine state, and memory addresses to the API caller. Details The panic recovery in...

CVE-2026-20289

A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. This vulnerability is due to the logging of sensitive information. An attacker could exploit this vulnerability by enabling a specific logging...

CVE-2026-12762

CVE-2026-12762 affects IBM Cloud Pak for Business Automation versions 24.0.0, 24.0.1, 25.0.0, and 26.0.0. The issue could allow a remote attacker to obtain sensitive information exposed in manifest files. The available documents do not specify the exact root cause, vulnerable component, or exploi...

CVE-2026-6639

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

EUVD-2026-53171

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

CVE-2026-6639

The CVE concerns the AI Chatbot & Workflow Automation by AIWU WordPress plugin (

CVE-2026-63456

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...

CVE-2026-63456

The CVE-2026-63456 entry describes multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator that allow an unauthenticated remote attacker to bypass web authentication and access system functions. The attacker could view and modify potentially sensitive information ...

CVE-2026-70372

Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions SELECT...

CVE-2026-70372 Koha - SQL Injection in reports/bor_issues_top.pl

Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha databa...

CVE-2026-70369

Koha's reports/acquisitionsstats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode,...

axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection

A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker...

WordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetSearch versions = 3.6.1.2...