CVE-2026-39372 | Medium | 4.9 | 2026-09-25 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores and serves uploaded ima… |
CVE-2026-54565 | Medium | 4.7 | 2026-09-17 | rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions… |
CVE-2026-61588 | Medium | 6.5 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django `Model` in… |
CVE-2026-92565 | Medium | 5.3 | 2026-09-16 | Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addr… |
CVE-2026-76855 | Medium | 6.5 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7_web_auth_log_dump_cgi.c, audi… |
CVE-2026-86904 | High | 7.5 | 2026-09-14 | A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be… |
CVE-2026-84606 | High | 7.5 | 2026-09-14 | A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may… |
CVE-2026-28938 | High | 7.5 | 2026-09-14 | A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to fingerprint the user. |
CVE-2026-28836 | Medium | 6.1 | 2026-09-14 | A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8.8. An attacker with physical access may be able to silently pe… |
CVE-2026-88875 | Medium | 4.3 | 2026-09-10 | AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video respons… |
CVE-2026-73008 | Medium | 5.5 | 2026-09-08 | Exposure of private personal information to an unauthorized actor in Windows Biometric Service allows an authorized attacker to disclose information locally. |
CVE-2026-69351 | Medium | 5.5 | 2026-09-08 | Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclo… |
CVE-2026-21827 | Low | 3.1 | 2026-08-31 | HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, cau… |
CVE-2026-53497 | Medium | 5.3 | 2026-08-21 | CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessi… |
CVE-2026-74966 | High | 7.5 | 2026-08-18 | Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. |
CVE-2026-58510 | Medium | 4.3 | 2026-08-13 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private |
CVE-2026-48048 | High | 7.5 | 2026-08-10 | XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to v… |
CVE-2026-24078 | Medium | 6.5 | 2026-08-04 | Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling. |
CVE-2026-55496 | Medium | 4.3 | 2026-07-31 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predic… |
CVE-2026-56171 | High | 7.1 | 2026-07-17 | Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-50657 | Medium | 4.7 | 2026-07-14 | Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally. |
CVE-2026-62328 | High | 7.5 | 2026-07-13 | 9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by se… |
CVE-2026-58297 | High | 7.1 | 2026-07-03 | Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a… |
CVE-2026-58296 | High | 7.1 | 2026-07-03 | Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a… |
CVE-2026-57960 | Medium | 6.5 | 2026-06-29 | Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists inc… |
CVE-2026-56124 | High | 7.5 | 2026-06-29 | phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploa… |
CVE-2026-48615 | High | 7.5 | 2026-06-26 | A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages.
When proxy credentials are embedded in th… |
CVE-2026-54264 | Medium | 6.1 | 2026-06-22 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, a… |
CVE-2026-49344 | | | 2026-06-19 | Mercator is an open source web application that enables mapping of the information system. Prior to version 2025.05.19, Mercator's Query Engine (`/admin/querie… |
CVE-2019-25762 | High | 7.5 | 2026-06-19 | Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by e… |
CVE-2025-30459 | Medium | 5.5 | 2026-06-11 | A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive user data. |
CVE-2026-26237 | High | 7.5 | 2026-06-10 | A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data… |
CVE-2026-25699 | Medium | 6.1 | 2026-06-09 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.0.
Timeline-r… |
CVE-2020-25900 | Medium | 5.3 | 2026-06-05 | HelloTalk through 3.4.1 stores full-precision GPS coordinates even when the user had intended to share only a country or city. Furthermore, these coordinates a… |
CVE-2026-8990 | | | 2026-05-28 | A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile application and grant himself full access to the device owne… |
CVE-2025-13477 | High | 7.1 | 2026-05-21 | Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiB… |
CVE-2026-28963 | Medium | 4.6 | 2026-05-11 | A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.5 and iPadOS 26.5. An attacker with physical access may be able to… |
CVE-2026-28906 | High | 7.5 | 2026-05-11 | This issue was addressed through improved state management. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7… |
CVE-2025-66172 | High | 8.1 | 2026-05-08 | The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0… |
CVE-2025-66171 | Medium | 6.5 | 2026-05-08 | The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated user-account access in CloudStack 4.21.0… |
CVE-2026-7382 | Medium | 6.5 | 2026-04-30 | Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability in MeWare Software… |
CVE-2026-41182 | Medium | 5.3 | 2026-04-23 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python… |
CVE-2026-28950 | Medium | 6.2 | 2026-04-22 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 15.8.8 and iPadOS 15.8.8, iOS 16.7.16 and iPadOS 16.7.16, iOS 18.7.8 and… |
CVE-2026-6765 | Medium | 5.3 | 2026-04-21 | Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10. |
CVE-2025-15623 | High | 7.5 | 2026-04-17 | Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability i… |
CVE-2026-34226 | High | 7.5 | 2026-03-27 | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current pa… |
CVE-2026-3911 | Low | 2.7 | 2026-03-11 | A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specif… |
CVE-2026-0102 | Low | 3.1 | 2026-02-17 | Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consen… |
CVE-2020-37173 | High | 7.5 | 2026-02-11 | AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php end… |
CVE-2026-24321 | Medium | 5.3 | 2026-02-10 | SAP Commerce Cloud exposes multiple API endpoints to unauthenticated users, allowing them to submit requests to these open endpoints to retrieve sensitive info… |
CVE-2025-66605 | Medium | 5.3 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
Since there are input
fields on this webpage with the autocomplete a… |
CVE-2026-24735 | High | 7.5 | 2026-02-04 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.7.1.
An unauthe… |
CVE-2025-11598 | | | 2026-02-03 | In mObywatel iOS application an unauthorized user can use the App Switcher to view the account owner's personal information in the minimized app window, even a… |
CVE-2025-14317 | | | 2026-01-14 | In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Se… |
CVE-2026-20834 | Medium | 4.6 | 2026-01-13 | Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack. |
CVE-2025-3950 | Low | 3.5 | 2026-01-09 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allow… |
CVE-2025-68945 | Medium | 5.8 | 2025-12-26 | In Gitea before 1.21.2, an anonymous user can visit a private user's project. |
CVE-2025-65857 | High | 7.5 | 2025-12-22 | An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. The GetStreamUri exposes RTSP URIs containing h… |
CVE-2025-13008 | | | 2025-12-19 | An information disclosure vulnerability in M-Files Server before versions 25.12.15491.7, 25.8 LTS SR3, 25.2 LTS SR3 and 24.8 LTS SR5 allows an authenticated at… |
CVE-2025-1030 | High | 7.5 | 2025-12-18 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Utarit Informatics Services Inc. SoliClub allows Query System for Informatio… |
CVE-2025-34441 | High | 7.5 | 2025-12-17 | AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administra… |
CVE-2025-10450 | High | 7.5 | 2025-12-16 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in RTI Connext Professional (Core Libraries) allows Sniffing Network Traffic. T… |
CVE-2025-0969 | Medium | 6.5 | 2025-12-13 | The Brizy – Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.16 via the get_users()… |
CVE-2025-66510 | Medium | 4.5 | 2025-12-05 | Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 2… |
CVE-2025-66027 | Medium | 6.5 | 2025-11-29 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, includ… |
CVE-2025-66035 | | | 2025-11-26 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16… |
CVE-2025-12536 | Medium | 5.3 | 2025-11-13 | The SureForms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.1 via the '_srfm_email_notificati… |
CVE-2025-11959 | High | 8.1 | 2025-11-11 | Files or Directories Accessible to External Parties, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Premierturk Information… |
CVE-2025-36131 | Medium | 4.6 | 2025-11-07 | IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and Windows (includes Db2 Connect Server) clpplus command exp… |
CVE-2025-52602 | Medium | 4.2 | 2025-11-05 | HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application. An HTTP GET endpoint request returns discoverable responses… |
CVE-2025-43500 | High | 7.5 | 2025-11-04 | A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, wat… |
CVE-2025-43496 | High | 7.5 | 2025-11-04 | The issue was addressed by adding additional logic. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS… |
CVE-2025-43469 | Medium | 5.5 | 2025-11-04 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may… |
CVE-2025-43452 | Medium | 4.6 | 2025-11-04 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 26.1 and iPadOS 26.1. Keyboard suggestions may display s… |
CVE-2025-43439 | Medium | 5.5 | 2025-11-04 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, visionOS 26.1. An app… |
CVE-2025-43409 | Medium | 5.5 | 2025-11-04 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1. An app may be able to ac… |
CVE-2025-43405 | High | 7.5 | 2025-11-04 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An… |
CVE-2025-43399 | High | 7.5 | 2025-11-04 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Tah… |
CVE-2025-43389 | Medium | 5.5 | 2025-11-04 | A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15… |
CVE-2025-11145 | High | 7.5 | 2025-10-24 | Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerabi… |
CVE-2025-35981 | Medium | 5.5 | 2025-10-23 | Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal… |
CVE-2025-62644 | Medium | 5.0 | 2025-10-17 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticat… |
CVE-2025-53950 | Medium | 5.5 | 2025-10-16 | An Exposure of Private Personal Information ('Privacy Violation') vulnerability [CWE-359] in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS and Window… |
CVE-2025-62362 | | | 2025-10-13 | gpp-burgerportaal is a Dutch government citizen portal application. In versions before 2.0.3, 3.0.2, and 4.0.1, the name and email address of employees who pub… |
CVE-2025-5009 | | | 2025-10-08 | In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conv… |
CVE-2025-10859 | Medium | 4.0 | 2025-09-30 | Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape Inc… |
CVE-2025-59843 | Medium | 5.3 | 2025-09-26 | Flag Forge is a Capture The Flag (CTF) platform. From versions 2.0.0 to before 2.3.2, the public endpoint /api/user/[username] returns user email addresses in… |
CVE-2025-43357 | Low | 3.3 | 2025-09-15 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia… |
CVE-2025-43310 | Medium | 4.4 | 2025-09-15 | A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be a… |
CVE-2025-43301 | Low | 3.3 | 2025-09-15 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 2… |
CVE-2025-43279 | Medium | 6.2 | 2025-09-15 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Tahoe 26. An app may be able to access user-se… |
CVE-2025-51586 | Low | 3.7 | 2025-09-08 | An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the r… |
CVE-2025-41685 | Medium | 6.5 | 2025-08-19 | A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address. |
CVE-2025-53765 | Medium | 4.4 | 2025-08-12 | Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally. |
CVE-2025-54125 | Medium | 6.5 | 2025-08-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old… |
CVE-2025-54124 | Medium | 6.5 | 2025-08-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old… |
CVE-2025-43259 | Medium | 4.6 | 2025-07-30 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7… |
CVE-2025-43227 | High | 7.5 | 2025-07-30 | This issue was addressed through improved state management. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, vision… |
CVE-2025-43217 | Medium | 4.0 | 2025-07-30 | The issue was addressed by adding additional logic. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Privacy Indicators for microphone or camera… |
CVE-2025-31276 | Medium | 5.3 | 2025-07-30 | This issue was addressed through improved state management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPadOS 17.7.9. Remote content may be loaded even w… |