Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...

Exposure of Sensitive Information Through Metadata

Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via CFB quick-check decryption oracle in the getDataStream method of PGPSymmetricKeyEncryptedData, reached through PGPPBEEncryptedData, PGPSessionKeyEncryptedData, and...

PT-2026-67537

Name of the Vulnerable Software and Affected Versions NASA cFS version 7.0.1 Description Incorrect access control in the DS SetDestPathCmd function allows attackers to access sensitive components through path traversal, a technique used to access files or directories outside the intended folder b...

CVE-2026-64371

A flaw was found in the Linux kernel's procfs a virtual filesystem that provides information about running processes. This vulnerability occurs because certain functions within procfs do not properly protect access to process memory information. A local attacker could exploit this missing...

Arbitrary File Read

Action Pack Active Storage is vulnerable to Arbitrary File Read. The vulnerability is due to unsafe libvips operations being permitted on untrusted image uploads, allowing attackers to craft malicious images that read arbitrary files accessible to the Rails process and expose sensitive applicatio...

Exposure Of Sensitive Information To An Unauthorized Actor

linuxfabrik-lib is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. The vulnerability is due to lib.url.fetch following cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, which allows an attacker controlling a...

WordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetSearch versions = 3.6.1.2...

WordPress JetBlocks For Elementor plugin <= 1.5.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetBlocks For Elementor versions = 1.5.0...

WordPress JetReviews plugin <= 3.0.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin JetReviews versions = 3.0.1...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Checkpoint Quantum_Spark_Firmware

!Read on Mediumhttps://img.shields.io/badge/Read%20on-Medium...

CVE-2026-18059

The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...

CVE-2026-17580

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

EUVD-2025-210580

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

CVE-2025-14073

The CVE-2025-14073 entry concerns the WooCommerce PayPal Payments plugin for WordPress (affected versions up to 3.3.2). It describes an Insecure Direct Object Reference flaw in the enqueue_paypal_insights_script_on_order_received() function caused by missing validation on a user-controlled key. T...

CVE-2026-2916

The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the enqueuescripts method in class/dashboard/class-dashboard.php. The plugin injects a JkitDashboardOption JavaScript object containing full plugin...

CVE-2026-17580

The CVE concerns the WordPress plugin Advanced Views (Display Custom Fields) versions up to and including 3.9.1. It exposes sensitive content via REST endpoints register_rest_routes (view-refresh and card-refresh), where an authenticated user with subscriber-level access or higher can access admi...

CVE-2026-17580 Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

CVE-2026-17580 Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

EUVD-2026-51762

The Advanced Views – Display Custom Fields ACF, Pods, MetaBox, Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the registerrestroutes. This makes it...

CVE-2026-18059

The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...