WordPress Polylang Pro plugin <= 3.8.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Polylang Pro versions = 3.8.5...

CVE-2026-66685: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...

CVE-2026-66696: Insertion of Sensitive Information Into Sent Data

Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks = 3.7.8 versions...

CVE-2026-66683: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript = 2.0.16 versions...

CVE-2026-66684: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-65543: Insertion of Sensitive Information Into Sent Data

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

CVE-2026-28169: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier = 2.52.0 versions...

PT-2026-68584

Name of the Vulnerable Software and Affected Versions Custom CSS and JavaScript versions prior to 2.0.17 Description An issue exists that allows unauthenticated users to cause sensitive data exposure. Recommendations Update to a version newer than 2.0.16...

PT-2026-68586

Name of the Vulnerable Software and Affected Versions Featured Video Plus versions prior to 2.3.4 Description An unauthenticated sensitive data exposure issue exists in the Featured Video Plus plugin, allowing unauthorized users to access confidential information. Recommendations Update to a...

CVE-2026-70630: Use of Uninitialized Resource

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...

PT-2026-68593

Name of the Vulnerable Software and Affected Versions Gutenberg Blocks by Kadence Blocks versions prior to 3.7.9 Description An issue exists that allows for the exposure of sensitive data to users with contributor-level permissions. Recommendations Update Gutenberg Blocks by Kadence Blocks to...

rclone: Verbose Stack Trace Disclosure in RC API Error Responses

Summary When an RC API call triggers a panic recovered by the job runner, the full Go stack trace is included in the JSON error response. This leaks internal file paths, Go module versions, goroutine state, and memory addresses to the API caller. Details The panic recovery in...

CVE-2026-20289

A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information. This vulnerability is due to the logging of sensitive information. An attacker could exploit this vulnerability by enabling a specific logging...

CVE-2026-12762

CVE-2026-12762 affects IBM Cloud Pak for Business Automation versions 24.0.0, 24.0.1, 25.0.0, and 26.0.0. The issue could allow a remote attacker to obtain sensitive information exposed in manifest files. The available documents do not specify the exact root cause, vulnerable component, or exploi...

WordPress YITH WooCommerce Zoom Magnifier plugin <= 2.52.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Que Thanh Tuan in WordPress Plugin YITH WooCommerce Zoom Magnifier versions = 2.52.0...

CVE-2026-6639

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

EUVD-2026-53171

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

CVE-2026-6639 AI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

CVE-2026-6639

The CVE concerns the AI Chatbot & Workflow Automation by AIWU WordPress plugin (

CVE-2026-63456

The CVE-2026-63456 entry describes multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator that allow an unauthenticated remote attacker to bypass web authentication and access system functions. The attacker could view and modify potentially sensitive information ...