137870 matches found
CVE-2026-0637 Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products
When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...
CVE-2026-18915
Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...
EUVD-2026-53819
Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...
CVE-2026-18915
CVE-2026-18915 affects eta-otp-lock (TÜBİTAK BİLGEM) prior to 1.0.4. The vulnerability is described as a vulnerability where a process can expose visible sensitive information, enabling system footprinting via command-line access. The CVSS 3.1 score is 5.0 (Medium), with local attack vector (AV:L...
WordPress Polylang Pro plugin <= 3.8.5 - Sensitive Data Exposure vulnerability
Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Polylang Pro versions = 3.8.5...
CVE-2026-16954 AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens
The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...
CVE-2025-13909: Exposure of Sensitive Information to an Unauthorized Actor
The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...
CVE-2026-70630: Use of Uninitialized Resource
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...
EulerOS 2.0 SP15 : gnutls (EulerOS-SA-2026-2925)
According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically f...
ROS-20260806-73-0026
The vulnerability of the Linux operating system’s kernel Wi-Fi module is related to the exposure of sensitive information. Exploiting this vulnerability allows an attacker to gain access to confidential data...
CVE-2026-66696: Insertion of Sensitive Information Into Sent Data
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks = 3.7.8 versions...
CVE-2026-5336: Exposure of Sensitive Information to an Unauthorized Actor
The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...
CVE-2026-45378: Exposure of Sensitive Information to an Unauthorized Actor
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verificationattachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to...
CVE-2026-66684: Insertion of Sensitive Information Into Sent Data
Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...
CVE-2026-71433: Exposure of Sensitive Information to an Unauthorized Actor
LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by...
EulerOS 2.0 SP15 : python-urllib3 (EulerOS-SA-2026-2946)
According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via...
CVE-2026-66685: Insertion of Sensitive Information Into Sent Data
Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...
CVE-2026-28169: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier = 2.52.0 versions...
CVE-2026-54489: Exposure of Sensitive Information to an Unauthorized Actor
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This...