CVE-2026-18915

CVE-2026-18915 affects eta-otp-lock (TÜBİTAK BİLGEM) prior to 1.0.4. The vulnerability is described as a vulnerability where a process can expose visible sensitive information, enabling system footprinting via command-line access. The CVSS 3.1 score is 5.0 (Medium), with local attack vector (AV:L...

EUVD-2026-53819

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

CVE-2026-18915

Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting. This issue affects eta-otp-lock: before 1.0.4...

WordPress Polylang Pro plugin <= 3.8.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Polylang Pro versions = 3.8.5...

CVE-2026-16954 AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens

The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being...

CVE-2026-54489: Exposure of Sensitive Information to an Unauthorized Actor

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This...

PT-2026-68450

Name of the Vulnerable Software and Affected Versions eta-otp-lock versions prior to 1.0.4 Description The software contains an issue where processes are invoked using visible sensitive information, which can be leveraged to perform system footprinting. System footprinting is a technique used to...

PT-2026-68569

Name of the Vulnerable Software and Affected Versions AI ANN versions prior to 1.29.1 Description The AI ANN - AI Generator & AI Agency WordPress Theme is subject to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object...

CVE-2026-5336: Exposure of Sensitive Information to an Unauthorized Actor

The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...

CVE-2026-28169: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier = 2.52.0 versions...

PT-2026-68584

Name of the Vulnerable Software and Affected Versions Custom CSS and JavaScript versions prior to 2.0.17 Description An issue exists that allows unauthenticated users to cause sensitive data exposure. Recommendations Update to a version newer than 2.0.16...

CVE-2026-66684: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-66685: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Featured Video Plus = 2.3.3 versions...

CVE-2026-70630: Use of Uninitialized Resource

FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder libavcodec/screenpresso.c that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that...

Dfence: Fine-Grained Speculation Barriers for Efficient and Effective Hardware-Software Protection in the Spectre Era (Extended Version)

Speculative execution attacks such as Spectre-PHT and Spectre-STL remain a critical security concern in modern processors. While software-based mitigations like Speculative Load Hardening SLH offer effective protection against Spectre-PHT, they are limited in scope and require software-managed...

CVE-2026-45378: Exposure of Sensitive Information to an Unauthorized Actor

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verificationattachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to...

CVE-2026-65543: Insertion of Sensitive Information Into Sent Data

Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...

CVE-2025-13909: Exposure of Sensitive Information to an Unauthorized Actor

The system accepts authentication requests without sufficient validation to enforce tenant isolation when using Email OTP, SMS OTP, or Magic Link as first-factor authenticators. This failure to adequately separate user data between tenants can lead to the exposure of personally identifiable...

PT-2026-68593

Name of the Vulnerable Software and Affected Versions Gutenberg Blocks by Kadence Blocks versions prior to 3.7.9 Description An issue exists that allows for the exposure of sensitive data to users with contributor-level permissions. Recommendations Update Gutenberg Blocks by Kadence Blocks to...

PT-2026-68585

Name of the Vulnerable Software and Affected Versions Export Import Menus versions prior to 1.9.3 Description An issue exists that allows unauthenticated users to access sensitive data through the software. Recommendations Update to a version newer than 1.9.2...