CVE-2026-94274 YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content...

CVE-2026-94274 YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content...

WordPress YayReviews plugin 1.0.4-1.4.0 - Unauthenticated Sensitive Data Disclosure vulnerability

Unauthenticated Sensitive Data Disclosure vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin YayReviews versions 1.0.4-1.4.0...

PT-2026-103236

Unauthenticated Sensitive Data Exposure in StifLi Backup Tools = 2.2.7 versions...

CVE-2026-97261: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in Notivo = 1.4.2 versions...

CVE-2026-97240: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in StifLi Backup Tools = 2.2.7 versions...

CVE-2026-96342: Missing Authorization

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83...

CVE-2026-102578: Improper Neutralization of Special Elements used in an SQL Command

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL Structured Query Language injection vulnerability. This issue could allow an attacker to view, alter, or delete...

PT-2026-103120

Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83...

PT-2026-103248

Unauthenticated Sensitive Data Exposure in Notivo = 1.4.2 versions...

PT-2026-103268

Unauthenticated Sensitive Data Exposure in MPG = 4.2.3 versions...

PT-2026-103237

Unauthenticated Sensitive Data Exposure in BackupEase = 2.2.2 versions...

PT-2026-103536

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description A stored SQL injection exists within an administrative reporting feature. This issue allows an authenticated administrator to read sensitive data from the underlying database and potentially...

PT-2026-103218

Subscriber Sensitive Data Exposure in GiveWP = 4.16.9 versions...

PT-2026-103054

The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data fields list' parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

PT-2026-103102

Information disclosure in BVMS 4.5 up to 12.3 including allows man-in-the-middle attackers to gain unauthorized access to sensitive data...

CVE-2026-97241: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in BackupEase = 2.2.2 versions...

CVE-2026-97302: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in MPG = 4.2.3 versions...

CVE-2026-100291 Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required authentication. This could allow an unauthorized attacker to access sensitive device operations...

CVE-2026-76735 Authenticated Local Sensitive Information Disclosure in HPE Networking Instant On

A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow an authenticated local attacker with high privileges to retrieve information which could be used to potentially gain further access to netwo...