CVE-2026-19603 | Medium | 4.3 | 2026-10-16 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user st… |
CVE-2026-19601 | Medium | 4.9 | 2026-10-16 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other co… |
CVE-2026-19541 | Medium | 6.5 | 2026-10-16 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validat… |
CVE-2026-110361 | Medium | 6.5 | 2026-10-15 | Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2026-109695 | High | 7.5 | 2026-10-15 | Insertion of Sensitive Information Into Sent Data vulnerability in WPManageNinja FluentCart fluent-cart allows Retrieve Embedded Sensitive Data.This issue affe… |
CVE-2026-75559 | Medium | 5.3 | 2026-10-15 | The smartphone application "Vehicle Inspection Certificate Viewer" contains a vulnerability in which sensitive information may be included in data transmitted… |
CVE-2026-66822 | Medium | 5.9 | 2026-10-13 | Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network. |
CVE-2026-52394 | Critical | 9.1 | 2026-10-13 | DeepSeek V4 is vulnerable to Incorrect Access Control via a crafted input. |
CVE-2026-89203 | Medium | 4.3 | 2026-10-13 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries… |
CVE-2026-108489 | Medium | 5.3 | 2026-10-13 | Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce a… |
CVE-2023-25996 | Medium | 6.5 | 2026-10-12 | Insertion of Sensitive Information Into Sent Data vulnerability in Pluggabl LLC. Booster Elite for WooCommerce booster-elite-for-woocommerce allows Retrieve Em… |
CVE-2026-107761 | | | 2026-10-11 | Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secret… |
CVE-2026-62043 | High | 7.5 | 2026-10-10 | Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions. |
CVE-2026-42630 | High | 7.5 | 2026-10-10 | Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions. |
CVE-2026-42419 | Medium | 5.9 | 2026-10-10 | Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions. |
CVE-2026-66435 | Medium | 5.9 | 2026-10-10 | Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This issue affe… |
CVE-2026-105877 | | | 2026-10-09 | Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2026-87109 | Medium | 5.3 | 2026-10-09 | An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that… |
CVE-2026-92555 | Critical | 9.8 | 2026-10-08 | Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Pan… |
CVE-2026-107315 | Medium | 5.3 | 2026-10-08 | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer in… |
CVE-2026-107313 | Medium | 4.2 | 2026-10-07 | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a… |
CVE-2026-106501 | Critical | 9.6 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affe… |
CVE-2026-66666 | | | 2026-10-06 | Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.
This issue affects WordPress… |
CVE-2026-105849 | High | 8.3 | 2026-10-06 | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users wi… |
CVE-2026-42413 | High | 7.5 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in Snapshotify – All-in-One Backup & Restore & Migrate <= 1.3.2 versions. |
CVE-2026-41562 | High | 7.5 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions. |
CVE-2026-41561 | High | 7.5 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions. |
CVE-2026-41559 | High | 7.5 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup & Restore <= 2.1.2 versions. |
CVE-2026-39791 | Medium | 5.3 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions. |
CVE-2026-39729 | High | 7.2 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions. |
CVE-2026-105071 | High | 7.5 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions. |
CVE-2026-104399 | | | 2026-10-06 | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data.
This issue affects Motors: f… |
CVE-2026-104385 | High | 7.5 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions. |
CVE-2026-41563 | High | 7.5 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions. |
CVE-2026-105742 | Low | 3.7 | 2026-10-05 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the H… |
CVE-2026-103334 | High | 7.5 | 2026-10-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations all… |
CVE-2026-105068 | Medium | 5.3 | 2026-10-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive Data.This issue af… |
CVE-2026-103335 | | | 2026-10-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Retr… |
CVE-2026-104402 | Medium | 4.3 | 2026-10-04 | Insertion of Sensitive Information Into Sent Data vulnerability in farvisun Mindio Magic MCP mindio-magic-mcp allows Retrieve Embedded Sensitive Data.This issu… |
CVE-2026-97307 | High | 7.5 | 2026-10-04 | Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Cost Calculator Builder cost-calculator-builder allows Retrieve Embedded Sens… |
CVE-2026-103957 | Medium | 6.2 | 2026-10-02 | Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token o… |
CVE-2026-32584 | Medium | 5.3 | 2026-10-02 | Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click… |
CVE-2026-101322 | | | 2026-10-01 | In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorizat… |
CVE-2026-62058 | Medium | 5.3 | 2026-10-01 | Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issu… |
CVE-2026-103345 | Medium | 5.3 | 2026-10-01 | Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue a… |
CVE-2026-103336 | Medium | 5.3 | 2026-10-01 | Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded… |
CVE-2026-103281 | Medium | 5.4 | 2026-10-01 | Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated… |
CVE-2026-103280 | Medium | 5.3 | 2026-10-01 | Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated request… |
CVE-2026-100258 | Medium | 4.3 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings |
CVE-2026-97302 | Medium | 5.3 | 2026-09-30 | Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions. |
CVE-2026-97261 | Medium | 5.3 | 2026-09-30 | Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. |
CVE-2026-97241 | High | 7.5 | 2026-09-30 | Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions. |
CVE-2026-97240 | High | 7.5 | 2026-09-30 | Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions. |
CVE-2026-86450 | High | 7.5 | 2026-09-29 | Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Fun… |
CVE-2026-101043 | High | 7.4 | 2026-09-27 | pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy setting… |
CVE-2026-63630 | Low | 3.4 | 2026-09-24 | BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from impor… |
CVE-2026-54649 | | | 2026-09-17 | punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers in… |
CVE-2026-82837 | Medium | 5.3 | 2026-09-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain condit… |
CVE-2026-91198 | Medium | 5.3 | 2026-09-14 | GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experime… |
CVE-2026-78336 | High | 7.5 | 2026-09-14 | Insertion of sensitive information into sent data vulnerability in Apache Syncope.
Any authenticated user can query for the list of available OIDC providers… |
CVE-2026-89332 | Medium | 5.5 | 2026-09-11 | Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthentic… |
CVE-2026-62088 | Medium | 5.3 | 2026-09-11 | Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data.
This issue affects ElasticPress… |
CVE-2026-81804 | High | 7.5 | 2026-09-10 | Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions. |
CVE-2026-78374 | | | 2026-09-10 | Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes a… |
CVE-2026-78303 | | | 2026-09-10 | Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously… |
CVE-2026-87015 | Medium | 6.8 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a co… |
CVE-2026-65812 | Medium | 6.8 | 2026-09-08 | Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. |
CVE-2026-86505 | Low | 3.3 | 2026-09-07 | In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace |
CVE-2026-86497 | Medium | 6.8 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox creden… |
CVE-2026-82209 | High | 8.2 | 2026-09-06 | When libpsl support is enabled, libcurl fails to enforce the Public Suffix
List boundary check when processing a `Set-Cookie` header where the `Domain`
attribu… |
CVE-2026-80255 | High | 7.5 | 2026-09-06 | A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of
space (ascii code 32) immediately before the `Secure` attribute causes curl to
store… |
CVE-2026-85307 | Medium | 5.3 | 2026-09-03 | Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data.
This issue affects KP… |
CVE-2026-77123 | Medium | 6.5 | 2026-09-02 | Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privile… |
CVE-2026-81162 | Medium | 5.3 | 2026-09-02 | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. T… |
CVE-2026-81280 | Medium | 6.5 | 2026-08-31 | Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions. |
CVE-2026-55553 | High | 7.5 | 2026-08-25 | urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows r… |
CVE-2026-66585 | High | 7.5 | 2026-08-24 | Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions. |
CVE-2026-59809 | Medium | 4.9 | 2026-08-22 | SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored… |
CVE-2026-63481 | | | 2026-08-20 | Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl… |
CVE-2026-75953 | High | 7.5 | 2026-08-19 | Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_i… |
CVE-2026-73386 | High | 7.5 | 2026-08-19 | Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions. |
CVE-2026-73384 | High | 7.5 | 2026-08-19 | Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions. |
CVE-2026-74008 | Medium | 5.3 | 2026-08-18 | Insertion of Sensitive Information Into Sent Data vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Retrieve Embe… |
CVE-2026-66463 | High | 7.5 | 2026-08-13 | Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions. |
CVE-2026-66443 | High | 7.5 | 2026-08-13 | Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions. |
CVE-2026-28174 | Medium | 6.5 | 2026-08-13 | Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions. |
CVE-2026-47717 | High | 7.5 | 2026-08-12 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project… |
CVE-2026-16637 | Medium | 6.5 | 2026-08-07 | OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id… |
CVE-2026-64652 | Low | 3.3 | 2026-08-06 | GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain… |
CVE-2026-66696 | Medium | 4.3 | 2026-08-06 | Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions. |
CVE-2026-66685 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions. |
CVE-2026-66684 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions. |
CVE-2026-66683 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions. |
CVE-2026-65543 | High | 7.5 | 2026-08-06 | Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. |
CVE-2026-66901 | High | 7.5 | 2026-08-04 | Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON.
… |
CVE-2026-20484 | Medium | 4.4 | 2026-08-03 | In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has… |
CVE-2026-67355 | Medium | 5.9 | 2026-08-01 | guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as ho… |
CVE-2026-67354 | Medium | 5.9 | 2026-08-01 | guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setti… |
CVE-2026-28144 | Medium | 4.3 | 2026-07-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data.
This issue affects WP Maps: f… |
CVE-2026-6267 | High | 8.5 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain… |