143790 matches found
CVE-2026-19074
The Advanced Classifieds & Directory Pro WordPress plugin (versions prior to 3.4.3 ) is vulnerable to unauthenticated sensitive information exposure. This issue occurs via the AJAX action acadp_public_custom_fields_listings, which allows unauthorized actors to disclose non-public listing custom f...
CVE-2026-19074
The Advanced Classifieds & Directory Pro Advanced Classifieds & Directory Pro WordPress plugin before 3.4.3 = 3.4.2 is vulnerable to unauthenticated sensitive information exposure via the AJAX action acadppubliccustomfieldslistings...
CVE-2026-18946 Contact Form to Any API < 3.0.7 - Unauthenticated Sensitive File Disclosure via Predictable Filename
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users...
CVE-2026-17542 Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including...
CVE-2026-17542
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including...
CVE-2026-17542
The File Manager WordPress plugin (versions before 6.9.1 ) contains a vulnerability in the bitapps_fm_connector endpoint. Due to a missing capability check , any authenticated user, such as a subscriber , can browse the entire WordPress installation directory. This allows attackers to download sp...
CVE-2026-17542 Bit File Manager < 6.9.1 - Subscriber+ Sensitive Data Disclosure via bitapps_fm_connector
The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including...
PT-2026-69836
Name of the Vulnerable Software and Affected Versions Zyxel Networks WAH7601 versions through 20072026 Description An insufficiently protected credentials issue allows the retrieval of embedded sensitive data. Recommendations At the moment, there is no information about a newer version that...
PT-2026-69976
Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.109.0 ERPNext versions prior to 16.20.0 Description An authenticated low-privilege user can perform SQL injection to extract sensitive information. This occurs because the get tax template function in...
PT-2026-69410
Name of the Vulnerable Software and Affected Versions Samsung Health versions prior to 7.0.0 Description A relative path traversal issue exists that allows local attackers to access sensitive information. Path traversal is a flaw that allows an attacker to access files and directories that are...
CVE-2026-72873: Exposure of Sensitive Information to an Unauthorized Actor
Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by findApplicationById in packages/server/src/services/application.ts without redacting githubClientSecret,...
CVE-2026-21077: Incorrect Authorization
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-12984: Insufficiently Protected Credentials
Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026...
CVE-2026-21076: Incorrect Authorization
Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...
CVE-2026-21081: Improper Export of Android Application Components
Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability...
CVE-2026-21084: Improper Access Control
Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information...
PT-2026-69404
Name of the Vulnerable Software and Affected Versions Samsung Health versions prior to 7.0.0 Description Incorrect authorization allows local attackers to access sensitive information. Recommendations Update to version 7.0.0 or later...
PT-2026-69411
Name of the Vulnerable Software and Affected Versions Smart Switch versions prior to 3.7.72.6 Description Improper input validation allows adjacent attackers to access sensitive data. Recommendations Update to version 3.7.72.6 or later...