CVE-2026-101148

The BackupSheep WordPress Backup Plugin (versions through 1.8 ) is vulnerable to unauthenticated access due to improper validation of its integration key . The plugin treats unset or blank keys as valid, enabling attackers to create and download full site backups —including databases with user pa...

CVE-2026-101148 BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...

EUVD-2026-90507

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...

CVE-2026-101148 BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...

CVE-2026-82826 Authentication information or sensitive data may be intercepted in transit

Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attacker to eavesdrop on with authentication credentials and sensitive data in transit. This issue affects Hitachi Coding Software Suite: through 3.3.0...

EUVD-2026-90493

Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attacker to eavesdrop on with authentication credentials and sensitive data in transit. This issue affects Hitachi Coding Software Suite: through 3.3.0...

Chromium CVE-2026-87482: Cleartext transmission of sensitive data in HttpsUpgrades

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

PT-2026-104023

Name of the Vulnerable Software and Affected Versions EasyIO FS32 versions prior to 3.0b63 Description Johnson Controls EasyIO FS32 contains a hard-coded cryptographic key, which is a fixed secret used for encryption or decryption. This flaw allows an attacker to retrieve embedded sensitive data...

PT-2026-104068

Name of the Vulnerable Software and Affected Versions Meari IoT Cloud Platform OpenAPI Service affected versions not specified Description An authorization flaw exists in the OpenAPI Service that allows authenticated users to manipulate configurations of devices they do not own. This issue enable...

CVE-2026-66247: Permissive Cross-domain Policy with Untrusted Domains

iControl is affected by an insecure Cross-Origin Resource Sharing CORS policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active...

CVE-2026-103336: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1...

CVE-2026-101148: External Control of File Name or Path

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...

PT-2026-103856

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

PT-2026-103855

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

PT-2026-103836

Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1...

CVE-2026-71449: Use of Hard-coded Cryptographic Key

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63...

CVE-2026-56589: Improper Neutralization of Input During Web Page Generation

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data...

CVE-2026-62058: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

PT-2026-103694

Name of the Vulnerable Software and Affected Versions BackupSheep WordPress Backup Plugin versions prior to 1.9 Description The plugin fails to properly validate its integration key, treating a blank or unset key as valid. This allows unauthenticated attackers to access backup and export endpoint...

Rocky Linux 9 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_36879)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202636879 advisory. Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-29146 Apache Tomcat: Apache Tomcat:...