143235 matches found
SUSE CVE-2026-91717
Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. Chromium security severity: High...
CVE-2026-2380
On affected platforms running Arista EOS with OpenConfig-related services i.e., gNMI, gNSI, RESTCONF and NETCONF, sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming vi...
CVE-2026-76555
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...
WordPress WP Import Export Lite plugin < 3.9.33 - Authenticated Sensitive File Disclosure vulnerability
Authenticated Sensitive File Disclosure vulnerability discovered by Hasyros in WordPress Plugin WP Import Export Lite versions 3.9.33...
CVE-2026-76555
The WP Import Export Lite WordPress plugin (versions before 3.9.33 ) is vulnerable to authenticated sensitive file disclosure via a path traversal flaw. The plugin fails to validate user-supplied file paths before reading and copying them into a publicly accessible directory. This allows any user...
EUVD-2026-80060
Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddnswanlistshow.cgi endpoint and related DDNSsetcgi, IGDGetCgiHandler, and IGDCgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing...
CVE-2026-92770: Exposure of Sensitive Information to an Unauthorized Actor
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...
CVE-2026-86448: Exposure of Sensitive Information to an Unauthorized Actor
The LearnPress WordPress plugin before 4.4.7 does not perform any authentication, capability or nonce check before serving a previously generated order export file, allowing unauthenticated attackers who can determine its identifier to download customer names, purchases, amounts and guest email...
CVE-2026-73174: Cleartext Transmission of Sensitive Information
Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a network-adjacent passive observer to intercept management traffic and recover sensitiv...
CVE-2026-76555: Improper Limitation of a Pathname to a Restricted Directory
The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...
Google Chrome Authorization Vulnerability (CNVD-2026-37837)
Google Chrome is a free web browser developed by Google Inc. There is an authorization vulnerability in Google Chrome, which stems from incorrect DataTransfer authorization. Attackers can exploit this vulnerability to obtain sensitive information through specially crafted HTML pages...
CVE-2026-85572: Exposure of Sensitive Information to an Unauthorized Actor
The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion content, allowing any authenticated user, such as a subscriber, to read comments from courses they are not enrolled in, including comments awaiting moderation...
CVE-2026-92594: Exposure of Sensitive Information to an Unauthorized Actor
Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers usergroups.:read, these fields are gated only on the elements.drafts:read / elements.revisions:read...
CVE-2026-82124: Exposure of Sensitive Information to an Unauthorized Actor
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check whether a post is password protected before including its content in the structured data it generates, allowing unauthenticated users to obtain the content of password protected posts via more than one public...
Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Shibboleth vulnerability (USN-8768-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8768-1 advisory. Florian Stuhlmann discovered that Shibboleth incorrectly escaped input when using the ODBC storage plugin. A remote attacker could possibl...
CVE-2026-91744
A race condition flaw was found in the PlatformIntegration component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=520019273...
CVE-2026-76871
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in modvpnremote/plan.json, pptpdusershow.cgi, pptpclientconfigshow.cgi, and l2tpdusershow.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials...
CVE-2026-76859
Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the userpassshow.cgi component. Low-privilege attackers can exploit this flaw via uiconfig2.xml and misc.js to disclose router credentials...
CVE-2026-76857
Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddnswanlistshow.cgi endpoint and related DDNSsetcgi, IGDGetCgiHandler, and IGDCgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing...