CVE-2026-58510 | Medium | 4.3 | 2026-08-13 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private |
CVE-2026-48048 | High | 7.5 | 2026-08-10 | XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to v… |
CVE-2026-24078 | Medium | 6.5 | 2026-08-04 | Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling. |
CVE-2026-55496 | Medium | 4.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predic… |
CVE-2026-56171 | High | 7.1 | 2026-07-17 | Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-50657 | Medium | 4.7 | 2026-07-14 | Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally. |
CVE-2026-62328 | High | 7.5 | 2026-07-13 | 9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by se… |
CVE-2026-58297 | High | 7.1 | 2026-07-03 | Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a… |
CVE-2026-58296 | High | 7.1 | 2026-07-03 | Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a… |
CVE-2026-57960 | Medium | 6.5 | 2026-06-29 | Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists inc… |
CVE-2026-56124 | High | 7.5 | 2026-06-29 | phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploa… |
CVE-2026-48615 | High | 7.5 | 2026-06-26 | A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.
When proxy credentials are embedded in th… |
CVE-2026-54264 | Medium | 6.1 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, a… |
CVE-2026-49344 | | | 2026-06-19 | Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine (`/admin/querie… |
CVE-2019-25762 | High | 7.5 | 2026-06-19 | Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by e… |
CVE-2025-30459 | Medium | 5.5 | 2026-06-11 | A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive user data. |
CVE-2026-26237 | High | 7.5 | 2026-06-10 | A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data… |
CVE-2026-25699 | Medium | 6.1 | 2026-06-09 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.0.
Timeline-r… |
CVE-2020-25900 | Medium | 5.3 | 2026-06-05 | HelloTalk through 3.4.1 stores full-precision GPS coordinates even when the user had intended to share only a country or city. Furthermore, these coordinates a… |
CVE-2026-8990 | | | 2026-05-28 | A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile application and grant himself full access to the device owne… |
CVE-2025-13477 | High | 7.1 | 2026-05-21 | Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiB… |
CVE-2026-28963 | Medium | 4.6 | 2026-05-11 | A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to… |
CVE-2026-28906 | High | 7.5 | 2026-05-11 | This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7… |
CVE-2025-66172 | High | 8.1 | 2026-05-08 | The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0… |
CVE-2025-66171 | Medium | 6.5 | 2026-05-08 | The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0… |
CVE-2026-7382 | Medium | 6.5 | 2026-04-30 | Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability in MeWare Software… |
CVE-2026-41182 | Medium | 5.3 | 2026-04-23 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python… |
CVE-2026-28950 | Medium | 6.2 | 2026-04-22 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 15.8.8 and iPadOS 15.8.8, iOS 16.7.16 and iPadOS 16.7.16, iOS 18.7.8 and… |
CVE-2026-6765 | Medium | 5.3 | 2026-04-21 | Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2025-15623 | High | 7.5 | 2026-04-17 | Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability i… |
CVE-2026-34226 | High | 7.5 | 2026-03-27 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current pa… |
CVE-2026-3911 | Low | 2.7 | 2026-03-11 | A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specif… |
CVE-2026-0102 | Low | 3.1 | 2026-02-17 | Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consen… |
CVE-2020-37173 | High | 7.5 | 2026-02-11 | AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php end… |
CVE-2026-24321 | Medium | 5.3 | 2026-02-10 | SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive info… |
CVE-2025-66605 | Medium | 5.3 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
Since there are input
fields on this webpage with the autocomplete a… |
CVE-2026-24735 | High | 7.5 | 2026-02-04 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.7.1.
An unauthe… |
CVE-2025-11598 | | | 2026-02-03 | In mObywatel iOS application an unauthorized user can use the App Switcher to view the account owner's personal information in the minimized app window, even a… |
CVE-2025-14317 | | | 2026-01-14 | In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Se… |
CVE-2026-20834 | Medium | 4.6 | 2026-01-13 | Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack. |
CVE-2025-3950 | Low | 3.5 | 2026-01-09 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allow… |
CVE-2025-68945 | Medium | 5.8 | 2025-12-26 | In Gitea before 1.21.2, an anonymous user can visit a private user's project. |
CVE-2025-65857 | High | 7.5 | 2025-12-22 | An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTSP URIs containing h… |
CVE-2025-13008 | | | 2025-12-19 | An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated at… |
CVE-2025-1030 | High | 7.5 | 2025-12-18 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Utarit Informatics Services Inc. SoliClub allows Query System for Informatio… |
CVE-2025-34441 | High | 7.5 | 2025-12-17 | AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administra… |
CVE-2025-10450 | High | 7.5 | 2025-12-16 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in RTI Connext Professional (Core Libraries) allows Sniffing Network Traffic.Th… |
CVE-2025-0969 | Medium | 6.5 | 2025-12-13 | The Brizy – Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.16 via the get_users()… |
CVE-2025-66510 | Medium | 4.5 | 2025-12-05 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 2… |
CVE-2025-66027 | Medium | 6.5 | 2025-11-29 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, includ… |
CVE-2025-66035 | | | 2025-11-26 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16… |
CVE-2025-12536 | Medium | 5.3 | 2025-11-13 | The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notificati… |
CVE-2025-11959 | High | 8.1 | 2025-11-11 | Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Premierturk Information… |
CVE-2025-36131 | Medium | 4.6 | 2025-11-07 | IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exp… |
CVE-2025-52602 | Medium | 4.2 | 2025-11-05 | HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application. An HTTP GET endpoint request returns discoverable responses… |
CVE-2025-43500 | High | 7.5 | 2025-11-04 | A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, wat… |
CVE-2025-43496 | High | 7.5 | 2025-11-04 | The issue was addressed by adding additional logic. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS… |
CVE-2025-43469 | Medium | 5.5 | 2025-11-04 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may… |
CVE-2025-43452 | Medium | 4.6 | 2025-11-04 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 26.1 and iPadOS 26.1. Keyboard suggestions may display s… |
CVE-2025-43439 | Medium | 5.5 | 2025-11-04 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, visionOS 26.1. An app… |
CVE-2025-43409 | Medium | 5.5 | 2025-11-04 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to ac… |
CVE-2025-43405 | High | 7.5 | 2025-11-04 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An… |
CVE-2025-43399 | High | 7.5 | 2025-11-04 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Tah… |
CVE-2025-43389 | Medium | 5.5 | 2025-11-04 | A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15… |
CVE-2025-11145 | High | 7.5 | 2025-10-24 | Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerabi… |
CVE-2025-35981 | Medium | 5.5 | 2025-10-23 | Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal… |
CVE-2025-62644 | Medium | 5.0 | 2025-10-17 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticat… |
CVE-2025-53950 | Medium | 5.5 | 2025-10-16 | An Exposure of Private Personal Information ('Privacy Violation') vulnerability [CWE-359] in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS and Window… |
CVE-2025-62362 | | | 2025-10-13 | gpp-burgerportaal is a Dutch government citizen portal application. In versions before 2.0.3, 3.0.2, and 4.0.1, the name and email address of employees who pub… |
CVE-2025-5009 | | | 2025-10-08 | In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conv… |
CVE-2025-10859 | Medium | 4.0 | 2025-09-30 | Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape Inc… |
CVE-2025-59843 | Medium | 5.3 | 2025-09-26 | Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in… |
CVE-2025-43357 | Low | 3.3 | 2025-09-15 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia… |
CVE-2025-43310 | Medium | 4.4 | 2025-09-15 | A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be a… |
CVE-2025-43301 | Low | 3.3 | 2025-09-15 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 2… |
CVE-2025-43279 | Medium | 6.2 | 2025-09-15 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Tahoe 26. An app may be able to access user-se… |
CVE-2025-51586 | Low | 3.7 | 2025-09-08 | An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the r… |
CVE-2025-41685 | Medium | 6.5 | 2025-08-19 | A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address. |
CVE-2025-53765 | Medium | 4.4 | 2025-08-12 | Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally. |
CVE-2025-54125 | Medium | 6.5 | 2025-08-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old… |
CVE-2025-54124 | Medium | 6.5 | 2025-08-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old… |
CVE-2025-43259 | Medium | 4.6 | 2025-07-30 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7… |
CVE-2025-43227 | High | 7.5 | 2025-07-30 | This issue was addressed through improved state management. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, vision… |
CVE-2025-43217 | Medium | 4.0 | 2025-07-30 | The issue was addressed by adding additional logic. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Privacy Indicators for microphone or camera… |
CVE-2025-31276 | Medium | 5.3 | 2025-07-30 | This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Remote content may be loaded even w… |
CVE-2025-53625 | | | 2025-07-10 | The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several #dpl par… |
CVE-2025-53374 | Medium | 4.3 | 2025-07-07 | Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated low-privi… |
CVE-2025-6017 | Medium | 5.5 | 2025-07-02 | A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability… |
CVE-2025-49715 | High | 7.5 | 2025-06-20 | Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose i… |
CVE-2025-49134 | Medium | 5.3 | 2025-06-16 | Weblate is a web based localization tool. Prior to version 5.12, the audit log notifications included the full IP address of the acting user. This could be obt… |
CVE-2025-5334 | High | 7.5 | 2025-05-29 | Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager
allows an authenticated us… |
CVE-2024-13953 | Medium | 4.9 | 2025-05-22 | Sensitive device logger information in ASPECT may be exposed if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*… |
CVE-2025-0679 | Medium | 4.3 | 2025-05-22 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Under certain condi… |
CVE-2023-45721 | Medium | 5.3 | 2025-04-30 | Insufficient default configuration in HCL Leap
allows anonymous access to directory information. |
CVE-2023-45720 | Medium | 5.3 | 2025-04-24 | Insufficient default configuration in HCL Leap
allows anonymous access to directory information. |
CVE-2024-42325 | Low | 3.5 | 2025-04-02 | Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc. |
CVE-2025-3035 | Medium | 5.3 | 2025-04-01 | By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This v… |
CVE-2024-10267 | High | 7.5 | 2025-03-20 | An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. An attacker can leak sensitive user information, including… |
CVE-2025-26816 | Medium | 6.5 | 2025-03-19 | A vulnerability in Intrexx Portal Server 12.0.2 and earlier which was classified as problematic potentially allows users with particular permissions under cert… |
CVE-2025-27080 | Medium | 6.0 | 2025-03-18 | Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Successful exploitation c… |