CVE-2026-103957 | Medium | 6.2 | 2026-10-02 | Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token o… |
CVE-2026-32584 | Medium | 5.3 | 2026-10-02 | Insertion of Sensitive Information Into Sent Data vulnerability in Chiranjit Hazarika Smart One Click Setup – Complete Demo Import & Export smart-one-click… |
CVE-2026-101322 | | | 2026-10-01 | In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's `Authorizat… |
CVE-2026-62058 | Medium | 5.3 | 2026-10-01 | Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issu… |
CVE-2026-103345 | Medium | 5.3 | 2026-10-01 | Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue a… |
CVE-2026-103336 | Medium | 5.3 | 2026-10-01 | Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded… |
CVE-2026-103281 | Medium | 5.4 | 2026-10-01 | Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts. An authenticated… |
CVE-2026-103280 | Medium | 5.3 | 2026-10-01 | Ghost from version 0.8.0 before 6.23.0 contains an information disclosure vulnerability in its setup endpoint: the endpoint responds to unauthenticated request… |
CVE-2026-100258 | Medium | 4.3 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings |
CVE-2026-97302 | Medium | 5.3 | 2026-09-30 | Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions. |
CVE-2026-97261 | Medium | 5.3 | 2026-09-30 | Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. |
CVE-2026-97241 | High | 7.5 | 2026-09-30 | Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions. |
CVE-2026-97240 | High | 7.5 | 2026-09-30 | Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions. |
CVE-2026-86450 | High | 7.5 | 2026-09-29 | Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Fun… |
CVE-2026-101043 | High | 7.4 | 2026-09-27 | pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy setting… |
CVE-2026-63630 | Low | 3.4 | 2026-09-24 | BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from impor… |
CVE-2026-54649 | | | 2026-09-17 | punchin-email is a Cloudflare Email Worker that provides two-way role aliases while relaying mail to a private inbox. Prior to 1.5.0, handleInbound delivers in… |
CVE-2026-82837 | Medium | 5.3 | 2026-09-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain condit… |
CVE-2026-91198 | Medium | 5.3 | 2026-09-14 | GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experime… |
CVE-2026-78336 | High | 7.5 | 2026-09-14 | Insertion of sensitive information into sent data vulnerability in Apache Syncope.
Any authenticated user can query for the list of available OIDC providers… |
CVE-2026-89332 | Medium | 5.5 | 2026-09-11 | Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow remote unauthentic… |
CVE-2026-62088 | Medium | 5.3 | 2026-09-11 | Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data.
This issue affects ElasticPress… |
CVE-2026-81804 | High | 7.5 | 2026-09-10 | Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions. |
CVE-2026-78374 | | | 2026-09-10 | Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor endpoint exposes a… |
CVE-2026-78303 | | | 2026-09-10 | Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4 - Booking inquiries previously… |
CVE-2026-87015 | Medium | 6.8 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a co… |
CVE-2026-65812 | Medium | 6.8 | 2026-09-08 | Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. |
CVE-2026-86505 | Low | 3.3 | 2026-09-07 | In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace |
CVE-2026-86497 | Medium | 6.8 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox creden… |
CVE-2026-82209 | High | 8.2 | 2026-09-06 | When libpsl support is enabled, libcurl fails to enforce the Public Suffix
List boundary check when processing a `Set-Cookie` header where the `Domain`
attribu… |
CVE-2026-80255 | High | 7.5 | 2026-09-06 | A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of
space (ascii code 32) immediately before the `Secure` attribute causes curl to
store… |
CVE-2026-85307 | Medium | 5.3 | 2026-09-03 | Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data.
This issue affects KP… |
CVE-2026-77123 | Medium | 6.5 | 2026-09-02 | Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privile… |
CVE-2026-81162 | Medium | 5.3 | 2026-09-02 | Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. T… |
CVE-2026-81280 | Medium | 6.5 | 2026-08-31 | Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions. |
CVE-2026-55553 | High | 7.5 | 2026-08-25 | urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows r… |
CVE-2026-66585 | High | 7.5 | 2026-08-24 | Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions. |
CVE-2026-59809 | Medium | 4.9 | 2026-08-22 | SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, allowing attackers to exfiltrate stored… |
CVE-2026-63481 | | | 2026-08-20 | Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl… |
CVE-2026-75953 | High | 7.5 | 2026-08-19 | Joomla Extension - cmsjunkie.com - Open mail relay in J-BusinessDirectory < 6.2.3 - Recipient address was taken from the request (contact_id_offer / contact_i… |
CVE-2026-73386 | High | 7.5 | 2026-08-19 | Unauthenticated Sensitive Data Exposure in Track Geolocation Of Users Using Contact Form 7 <= 3.0.2 versions. |
CVE-2026-73384 | High | 7.5 | 2026-08-19 | Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions. |
CVE-2026-74008 | Medium | 5.3 | 2026-08-18 | Unauthenticated Sensitive Data Exposure in Shortcodes and extra features for Phlox theme <= 2.17.22 versions. |
CVE-2026-66463 | High | 7.5 | 2026-08-13 | Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions. |
CVE-2026-66443 | High | 7.5 | 2026-08-13 | Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions. |
CVE-2026-28174 | Medium | 6.5 | 2026-08-13 | Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions. |
CVE-2026-47717 | High | 7.5 | 2026-08-12 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project… |
CVE-2026-16637 | Medium | 6.5 | 2026-08-07 | OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id… |
CVE-2026-64652 | Low | 3.3 | 2026-08-06 | GitHub CLI (gh) is GitHub's official command line tool. Prior to version 2.97.0, gh auth status masked only the characters after the last underscore in certain… |
CVE-2026-66696 | Medium | 4.3 | 2026-08-06 | Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions. |
CVE-2026-66685 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions. |
CVE-2026-66684 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions. |
CVE-2026-66683 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions. |
CVE-2026-65543 | High | 7.5 | 2026-08-06 | Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. |
CVE-2026-66901 | High | 7.5 | 2026-08-04 | Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON.
… |
CVE-2026-20484 | Medium | 4.4 | 2026-08-03 | In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has… |
CVE-2026-67355 | Medium | 5.9 | 2026-08-01 | guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as ho… |
CVE-2026-67354 | Medium | 5.9 | 2026-08-01 | guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setti… |
CVE-2026-28144 | Medium | 4.3 | 2026-07-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data.
This issue affects WP Maps: f… |
CVE-2026-6267 | High | 8.5 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain… |
CVE-2026-67425 | High | 8.6 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_AP… |
CVE-2026-54660 | High | 7.4 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestH… |
CVE-2026-64643 | Medium | 5.3 | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications usin… |
CVE-2026-65434 | Medium | 6.5 | 2026-07-27 | Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions. |
CVE-2026-66339 | Medium | 6.5 | 2026-07-24 | A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subseq… |
CVE-2026-16798 | Medium | 6.5 | 2026-07-24 | Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated u… |
CVE-2026-27372 | Medium | 6.5 | 2026-07-23 | Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions. |
CVE-2026-12547 | Low | 3.4 | 2026-07-21 | SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., vi… |
CVE-2026-13380 | High | 7.5 | 2026-07-20 | VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are p… |
CVE-2026-54171 | Medium | 6.5 | 2026-07-17 | Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when followin… |
CVE-2026-7488 | High | 7.5 | 2026-07-17 | Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data.
This issue affects… |
CVE-2026-7189 | High | 7.5 | 2026-07-17 | Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constraine… |
CVE-2026-44970 | Low | 3.1 | 2026-07-16 | dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/trac… |
CVE-2026-56460 | Medium | 6.5 | 2026-07-09 | HCL DevOps Deploy / HCL Launch could disclose sensitive configurations and secrets to authenticated users in API responses that could be used in further attack… |
CVE-2026-1365 | Medium | 6.5 | 2026-07-09 | Insertion of sensitive information into sent data vulnerability in Sayax Energy Technologies Inc. OSOS allows Authentication Bypass.
This issue affects OSOS… |
CVE-2026-42505 | Medium | 5.3 | 2026-07-08 | Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unenc… |
CVE-2026-59519 | Medium | 5.3 | 2026-07-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Softaculous FormLayer allows Retrieve Embedded Sensitive Data.
This issue affects FormLayer… |
CVE-2026-59511 | Medium | 5.3 | 2026-07-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Tim Strifler Exclusive Addons Elementor allows Retrieve Embedded Sensitive Data.
This issue… |
CVE-2026-8924 | Critical | 9.1 | 2026-07-03 | A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set
"super cookies" that bypass the Public Suffix List check. This enables an
attacker-… |
CVE-2026-57347 | Medium | 6.5 | 2026-07-02 | Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions. |
CVE-2025-69132 | Medium | 6.5 | 2026-07-02 | Subscriber Sensitive Data Exposure in Corpkit <= 1.0.5 versions. |
CVE-2026-57736 | High | 7.4 | 2026-07-01 | Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data.
This issue affects HubSpot: from n/a throu… |
CVE-2026-13211 | Medium | 4.3 | 2026-07-01 | The genucenter web interface before version 8.0p11 unnecessarily exposes sensitive SNMP authentication and encryption keys in its HTTP responses to users with… |
CVE-2026-12085 | Medium | 6.5 | 2026-06-30 | IBM UCD - IBM UrbanCode Deploy 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevO… |
CVE-2026-13437 | Medium | 6.5 | 2026-06-29 | Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Age… |
CVE-2026-57318 | Medium | 6.5 | 2026-06-26 | Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions. |
CVE-2026-54834 | High | 7.5 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions. |
CVE-2026-55180 | Medium | 6.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace… |
CVE-2026-54848 | High | 8.3 | 2026-06-25 | Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data.
This… |
CVE-2026-54841 | High | 7.5 | 2026-06-25 | Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions. |
CVE-2026-54821 | High | 7.4 | 2026-06-25 | Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions. |
CVE-2026-22551 | Medium | 6.5 | 2026-06-18 | In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs with… |
CVE-2026-52698 | High | 7.4 | 2026-06-17 | Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions. |
CVE-2026-34888 | High | 7.5 | 2026-06-17 | Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions. |
CVE-2026-27868 | | | 2026-06-17 | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerabl… |
CVE-2024-35690 | Medium | 6.5 | 2026-06-17 | Insertion of sensitive information into sent data vulnerability in MarketingFire Widget Options allows Retrieve Embedded Sensitive Data.
This issue affects Wi… |
CVE-2026-54197 | Medium | 6.5 | 2026-06-16 | Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions. |
CVE-2026-52695 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions. |
CVE-2026-52692 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions. |
CVE-2026-49082 | High | 7.4 | 2026-06-15 | Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 v… |