CVE-2026-66463 | High | 7.5 | 2026-08-13 | Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions. |
CVE-2026-66443 | High | 7.5 | 2026-08-13 | Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions. |
CVE-2026-28174 | Medium | 6.5 | 2026-08-13 | Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions. |
CVE-2026-47717 | High | 7.5 | 2026-08-12 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project… |
CVE-2026-16637 | Medium | 6.5 | 2026-08-07 | OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id… |
CVE-2026-64652 | Low | 3.3 | 2026-08-06 | GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain… |
CVE-2026-66696 | Medium | 4.3 | 2026-08-06 | Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions. |
CVE-2026-66685 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions. |
CVE-2026-66684 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions. |
CVE-2026-66683 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions. |
CVE-2026-65543 | High | 7.5 | 2026-08-06 | Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. |
CVE-2026-66901 | High | 7.5 | 2026-08-04 | Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON.
… |
CVE-2026-20484 | Medium | 4.4 | 2026-08-03 | In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has… |
CVE-2026-67355 | Medium | 5.9 | 2026-08-01 | guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as ho… |
CVE-2026-67354 | Medium | 5.9 | 2026-08-01 | guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setti… |
CVE-2026-28144 | Medium | 4.3 | 2026-07-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data.
This issue affects WP Maps: f… |
CVE-2026-6267 | High | 8.5 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain… |
CVE-2026-67425 | High | 8.6 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_AP… |
CVE-2026-54660 | High | 7.4 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestH… |
CVE-2026-64643 | Medium | 5.3 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications usin… |
CVE-2026-65434 | Medium | 6.5 | 2026-07-27 | Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions. |
CVE-2026-66339 | Medium | 6.5 | 2026-07-24 | A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subseq… |
CVE-2026-16798 | Medium | 6.5 | 2026-07-24 | Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated u… |
CVE-2026-27372 | Medium | 6.5 | 2026-07-23 | Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions. |
CVE-2026-12547 | Low | 3.4 | 2026-07-21 | SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., vi… |
CVE-2026-13380 | High | 7.5 | 2026-07-20 | VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are p… |
CVE-2026-54171 | Medium | 6.5 | 2026-07-17 | Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when followin… |
CVE-2026-7488 | High | 7.5 | 2026-07-17 | Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data.
This issue affects… |
CVE-2026-7189 | High | 7.5 | 2026-07-17 | Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constraine… |
CVE-2026-44970 | Low | 3.1 | 2026-07-16 | dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/trac… |
CVE-2026-56460 | Medium | 6.5 | 2026-07-09 | HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attack… |
CVE-2026-1365 | Medium | 6.5 | 2026-07-09 | Insertion of sensitive information into sent data vulnerability in Sayax Energy Technologies Inc. OSOS allows Authentication Bypass.
This issue affects OSOS… |
CVE-2026-42505 | Medium | 5.3 | 2026-07-08 | Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unenc… |
CVE-2026-59519 | Medium | 5.3 | 2026-07-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Softaculous FormLayer allows Retrieve Embedded Sensitive Data.
This issue affects FormLayer… |
CVE-2026-59511 | Medium | 5.3 | 2026-07-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Tim Strifler Exclusive Addons Elementor allows Retrieve Embedded Sensitive Data.
This issue… |
CVE-2026-57347 | Medium | 6.5 | 2026-07-02 | Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions. |
CVE-2025-69132 | Medium | 6.5 | 2026-07-02 | Subscriber Sensitive Data Exposure in Corpkit <= 1.0.5 versions. |
CVE-2026-57736 | High | 7.4 | 2026-07-01 | Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data.
This issue affects HubSpot: from n/a throu… |
CVE-2026-13211 | Medium | 4.3 | 2026-07-01 | The genucenter web interface before version 8.0p11 unnecessarily exposes sensitive SNMP authentication and encryption keys in its HTTP responses to users with… |
CVE-2026-12085 | Medium | 6.5 | 2026-06-30 | IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevO… |
CVE-2026-13437 | Medium | 6.5 | 2026-06-29 | Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Age… |
CVE-2026-57318 | Medium | 6.5 | 2026-06-26 | Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions. |
CVE-2026-54834 | High | 7.5 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions. |
CVE-2026-55180 | Medium | 6.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace… |
CVE-2026-54848 | High | 8.3 | 2026-06-25 | Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data.
This… |
CVE-2026-54841 | High | 7.5 | 2026-06-25 | Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions. |
CVE-2026-54821 | High | 7.4 | 2026-06-25 | Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions. |
CVE-2026-22551 | Medium | 6.5 | 2026-06-18 | In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs with… |
CVE-2026-52698 | High | 7.4 | 2026-06-17 | Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions. |
CVE-2026-34888 | High | 7.5 | 2026-06-17 | Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions. |
CVE-2026-27868 | | | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerabl… |
CVE-2024-35690 | Medium | 6.5 | 2026-06-17 | Insertion of sensitive information into sent data vulnerability in MarketingFire Widget Options allows Retrieve Embedded Sensitive Data.
This issue affects Wi… |
CVE-2026-54197 | Medium | 6.5 | 2026-06-16 | Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions. |
CVE-2026-52695 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions. |
CVE-2026-52692 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions. |
CVE-2026-49082 | High | 7.4 | 2026-06-15 | Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 v… |
CVE-2026-48965 | Medium | 6.5 | 2026-06-15 | Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions. |
CVE-2026-42667 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Bookly <= 27.4 versions. |
CVE-2026-42384 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11.2 versions. |
CVE-2026-40789 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions. |
CVE-2026-39480 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions. |
CVE-2026-49064 | High | 7.5 | 2026-06-15 | Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data.
This issue affects GetPaid: from n… |
CVE-2026-7184 | Medium | 6.5 | 2026-06-12 | Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows… |
CVE-2026-44487 | High | 7.5 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization he… |
CVE-2026-44486 | High | 7.5 | 2026-06-11 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redir… |
CVE-2026-46481 | High | 8.3 | 2026-06-08 | OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and re… |
CVE-2026-42539 | Medium | 6.5 | 2026-06-04 | IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive da… |
CVE-2026-45739 | Low | 3.1 | 2026-06-04 | Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the Gr… |
CVE-2026-4035 | High | 7.7 | 2026-06-03 | A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to e… |
CVE-2026-44653 | Medium | 6.5 | 2026-06-02 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, users with only `VIEW` access to an MCP serv… |
CVE-2026-35447 | | | 2026-06-02 | NamelessMC is website software for Minecraft servers. In version 2.2.4, the profile page (modules/Core/pages/profile.php) processes wall post submissions and r… |
CVE-2026-42673 | High | 7.5 | 2026-06-01 | Insertion of Sensitive Information Into Sent Data vulnerability in Logtivity Activity Logs Activity Logs, User Activity Tracking, Multisite Activity Log from L… |
CVE-2026-49370 | Low | 3.4 | 2026-05-29 | In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests |
CVE-2026-10101 | Medium | 6.3 | 2026-05-29 | ACM/MCE assisted-service writes raw referenced pull-secret contents into `InfraEnv.status.conditions[].message` when pull-secret validation fails. A namespace… |
CVE-2026-45582 | Medium | 6.5 | 2026-05-29 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.51.3, the workflow telemetry sani… |
CVE-2026-42746 | High | 7.3 | 2026-05-27 | Insertion of Sensitive Information Into Sent Data vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Retrieve Embedded Sensitiv… |
CVE-2026-48877 | Medium | 6.5 | 2026-05-27 | Insertion of Sensitive Information Into Sent Data vulnerability in Tom GenerateBlocks allows Retrieve Embedded Sensitive Data.
This issue affects GenerateBloc… |
CVE-2026-41181 | Medium | 5.8 | 2026-05-15 | Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerability in Traefik's err… |
CVE-2025-62309 | Low | 2.6 | 2026-05-14 | HCL AION is affected by a vulnerability where auto-complete functionality is enabled for certain input fields. This may allow sensitive information to be store… |
CVE-2025-62308 | Medium | 5.1 | 2026-05-14 | HCL AION is affected by a vulnerability where sensitive backend infrastructure details may be exposed. Exposure of such information could reveal internal syste… |
CVE-2025-62305 | Medium | 5.1 | 2026-05-14 | HCL AION is affected by a vulnerability where certain operations may trigger out-of-band interactions, potentially resulting in unintended disclosure of sensit… |
CVE-2026-45215 | Medium | 5.3 | 2026-05-12 | Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2026-42880 | Critical | 9.6 | 2026-05-07 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing au… |
CVE-2025-31978 | Medium | 4.6 | 2026-05-06 | HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An… |
CVE-2026-42997 | High | 7.7 | 2026-05-05 | An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a remote endpo… |
CVE-2026-42379 | High | 7.7 | 2026-04-27 | Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data.This issue affects Templately… |
CVE-2026-42042 | Medium | 5.4 | 2026-04-24 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, the Axios library's XSRF token protection logic uses JavaScript t… |
CVE-2026-5512 | Medium | 4.3 | 2026-04-21 | An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private rep… |
CVE-2026-40161 | High | 7.7 | 2026-04-21 | Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2… |
CVE-2026-40293 | Medium | 6.5 | 2026-04-17 | OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentic… |
CVE-2026-4525 | High | 7.5 | 2026-04-17 | If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarde… |
CVE-2025-41118 | Critical | 9.1 | 2026-04-15 | Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS).
If th… |
CVE-2026-5483 | High | 8.5 | 2026-04-10 | A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the d… |
CVE-2026-39912 | Critical | 9.1 | 2026-04-09 | V2Board 1.6.1 through 1.7.4 and Xboard through 0.1.9 expose authentication tokens in HTTP response bodies of the loginWithMailLink endpoint when the login_with… |
CVE-2026-39711 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions allows Retrieve Embedded Sensitive Data.This… |
CVE-2026-39709 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal the-tech-tribe allows Retrieve Embedded Sensitive Data.This issue af… |
CVE-2026-39586 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This i… |
CVE-2026-39570 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive… |
CVE-2026-39564 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Retrieve Embedded Sensitive… |
CVE-2026-39542 | Medium | 5.3 | 2026-04-08 | Insertion of Sensitive Information Into Sent Data vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensi… |