7994 matches found
CVE-2025-36374 IBM DataPower Gateway affected by XML external entity injection
IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...
CVE-2026-28814
Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue...
CVE-2026-28814 Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering
Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. Users are recommended to upgrade to version 2.12.4 or 3.0.0, which fixes this issue...
CVE-2026-16553 Insufficiently Protected Credentials in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in...
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.8 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin Gutenberg Blocks by Kadence Blocks versions = 3.7.8...
CVE-2026-63230
A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...
PT-2026-65700
A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO OAuth endpoint to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable...
CVE-2026-14512 IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information
IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code...
CVE-2026-14528
IBM WebSphere Application Server 9.0 and 8.5 traditional are affected by a vulnerability stemming from unsafe deserialization that could allow a remote attacker to obtain sensitive information. The issue is described in connected records as an unsafe deserialization path exposing confidential dat...
CVE-2026-16581
In igloohome Smart Lock Mobile App versions 3.2.3 and earlier, the CVE-2026-16581 describes an Inclusion of Sensitive Information in Source Code that could allow an unauthorized actor to access functions or backend services not sufficiently protected by authentication controls. The affected softw...
CVE-2026-6881
Summary: CVE-2026-6881 describes an SQL injection in Ellucian Advance Web and Legacy Advance (Giving Reports) that allows an authenticated attacker to exfiltrate data by crafting SQL in the class credit field. Affected products: Ellucian Advance Web and Legacy Advance (all versions). Ellucian CRM...
CVE-2026-58023
A flaw was found in Apache Thrift cglib bindings. This out-of-bounds read vulnerability allows an attacker to potentially access sensitive information or cause a denial of service. The vulnerability occurs when the software attempts to read data beyond the allocated memory buffer...
WordPress Vimeo plugin <= 1.2.2 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by 0xzenko in WordPress Plugin Vimeo versions = 1.2.2...
CVE-2026-58331
A flaw was found in the Moodle Database Activity module. This vulnerability allows an attacker to perform an arbitrary file read through the module's import feature. This could lead to the disclosure of sensitive information from the system...
EUVD-2026-49469
This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 26.6 and iPadOS 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Sensitive Information Exposure in LangSmith [CVE-2026-41182]
Summary IBM Watson Speech Services Cartridge is vulnerable to Sensitive Information Exposure in LangSmith, due to an issue that causes a bypass of the redaction pipeline CVE-2026-41182. LangSmith is used in our runtime postprocessor. This vulnerability has been addressed. Please read the details...
WordPress ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure vulnerability
Insecure Direct Object Reference to Authenticated Contributor+ Sensitive Information Exposure vulnerability discovered by Wordfence PRISM in WordPress Plugin ShopLentor versions = 3.4.5...
CVE-2025-59178
Ericsson Packet Core Controller PCC versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system...