CVE-2026-97181 | Medium | 5.3 | 2026-09-24 | GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs. |
CVE-2026-84712 | Medium | 5.3 | 2026-09-23 | A flaw was found in the automation-controller API. The
unauthenticated health-check endpoint /api/v2/ping/
(ApiV2PingView… |
CVE-2026-95600 | Medium | 5.3 | 2026-09-23 | Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions. |
CVE-2025-33141 | Medium | 6.5 | 2026-09-18 | IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permis… |
CVE-2026-27553 | Medium | 6.5 | 2026-09-16 | A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user co… |
CVE-2026-38058 | High | 8.1 | 2026-09-11 | The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt pass… |
CVE-2026-61911 | Medium | 4.3 | 2026-09-09 | An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed… |
CVE-2026-81394 | Medium | 5.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information lo… |
CVE-2026-81387 | Medium | 5.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information lo… |
CVE-2026-71330 | High | 7.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to dis… |
CVE-2026-69832 | Medium | 5.6 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-69723 | Medium | 5.7 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information over a netwo… |
CVE-2026-69406 | Medium | 5.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-69339 | Medium | 5.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information… |
CVE-2026-69315 | Medium | 5.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows License Manager allows an authorized attacker to disclose information loc… |
CVE-2026-68842 | Medium | 5.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information… |
CVE-2026-16006 | | | 2026-09-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a… |
CVE-2026-76968 | Medium | 6.5 | 2026-09-08 | SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative func… |
CVE-2026-80119 | High | 7.8 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vu… |
CVE-2026-80118 | High | 7.1 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical… |
CVE-2026-66840 | High | 7.5 | 2026-09-04 | XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked. |
CVE-2026-81774 | High | 7.5 | 2026-09-02 | Unauthenticated Sensitive Data Exposure in WooCommerce Product Attachment <= 2.3.3 versions. |
CVE-2026-53682 | Medium | 5.3 | 2026-09-01 | An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating int… |
CVE-2026-78268 | High | 7.5 | 2026-08-24 | Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versi… |
CVE-2026-75928 | Medium | 5.3 | 2026-08-21 | The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unau… |
CVE-2026-67267 | Medium | 5.5 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. A low… |
CVE-2026-74007 | Medium | 5.3 | 2026-08-18 | Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions. |
CVE-2026-32468 | High | 7.5 | 2026-08-18 | Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions. |
CVE-2024-58375 | High | 7.5 | 2026-08-16 | OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, v… |
CVE-2026-66462 | High | 7.5 | 2026-08-13 | Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions. |
CVE-2026-66444 | Medium | 6.5 | 2026-08-13 | Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions. |
CVE-2025-15680 | | | 2026-08-10 | TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device's circuit board without sufficient protection. A physically proximate attacker can connect… |
CVE-2026-6373 | Medium | 6.5 | 2026-08-10 | Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting.
This… |
CVE-2026-69127 | | | 2026-08-07 | Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error mes… |
CVE-2026-17595 | Low | 2.7 | 2026-08-07 | Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct a… |
CVE-2026-28169 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions. |
CVE-2026-44945 | Critical | 9.1 | 2026-08-05 | A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the de… |
CVE-2026-56569 | Medium | 4.0 | 2026-07-31 | HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web serve… |
CVE-2026-58246 | Medium | 4.3 | 2026-07-28 | SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated… |
CVE-2026-66438 | Medium | 5.3 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions. |
CVE-2026-65564 | Medium | 5.3 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions. |
CVE-2026-59548 | High | 7.5 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions. |
CVE-2026-59528 | High | 7.5 | 2026-07-27 | Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions. |
CVE-2025-59178 | | | 2026-07-27 | Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allo… |
CVE-2026-44955 | Medium | 5.3 | 2026-07-23 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could all… |
CVE-2026-28698 | High | 8.6 | 2026-07-23 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could exp… |
CVE-2026-65535 | Medium | 4.3 | 2026-07-23 | Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions. |
CVE-2026-65521 | Medium | 5.3 | 2026-07-23 | Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions. |
CVE-2026-65505 | Medium | 5.3 | 2026-07-23 | Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions. |
CVE-2026-65498 | Medium | 5.3 | 2026-07-23 | Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions. |
CVE-2026-65490 | Medium | 5.3 | 2026-07-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embed… |
CVE-2026-65474 | Medium | 5.3 | 2026-07-23 | Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions. |
CVE-2026-65458 | Medium | 4.3 | 2026-07-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Se… |
CVE-2026-61945 | Medium | 6.5 | 2026-07-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedd… |
CVE-2023-37507 | High | 7.5 | 2026-07-21 | HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed. |
CVE-2026-16072 | Medium | 4.9 | 2026-07-17 | A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitati… |
CVE-2026-10588 | Medium | 4.4 | 2026-07-16 | A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory. |
CVE-2026-50294 | Medium | 6.2 | 2026-07-14 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally. |
CVE-2026-61977 | Medium | 5.3 | 2026-07-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive… |
CVE-2026-61976 | Medium | 5.3 | 2026-07-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embed… |
CVE-2026-61975 | Medium | 5.3 | 2026-07-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitiv… |
CVE-2026-57393 | Medium | 6.5 | 2026-07-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder… |
CVE-2026-14808 | Critical | 9.8 | 2026-07-06 | Prog
Management System developed by PROG MIS has a Exposure of Sensitive
Information vulnerability, allowing unauthenticated remote attackers to view
a s… |
CVE-2026-55726 | Medium | 5.3 | 2026-07-03 | The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device l… |
CVE-2026-57753 | Medium | 5.3 | 2026-07-02 | Unauthenticated Sensitive Data Exposure in Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 versions. |
CVE-2026-56124 | High | 7.5 | 2026-06-29 | phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploa… |
CVE-2026-57664 | Medium | 4.3 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in Bopo – WooCommerce Product Bundle Builder <= 1.1.6 versions. |
CVE-2026-57633 | Medium | 5.3 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in WCBoost – Products Compare <= 1.1.0 versions. |
CVE-2026-57316 | Medium | 6.5 | 2026-06-26 | Subscriber Sensitive Data Exposure in GetGenie <= 4.4.2 versions. |
CVE-2026-56060 | High | 7.5 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions. |
CVE-2026-54824 | High | 7.5 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in Ads by WPQuads <= 3.0.3 versions. |
CVE-2026-9307 | | | 2026-06-16 | A sensitive information disclosure security issue exists within the affected CompactLogix controllers. The controller's web server exposes CIP Connection IDs o… |
CVE-2026-52694 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions. |
CVE-2026-49068 | High | 7.5 | 2026-06-15 | Subscriber Sensitive Data Exposure in Coupon Affiliates <= 7.8.1 versions. |
CVE-2026-49066 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions. |
CVE-2026-49056 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions. |
CVE-2026-48878 | Medium | 6.5 | 2026-06-15 | Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.4.1 versions. |
CVE-2026-42660 | Medium | 6.5 | 2026-06-15 | Subscriber Sensitive Data Exposure in Contest Gallery <= 28.1.7 versions. |
CVE-2026-40796 | Medium | 6.5 | 2026-06-15 | Subscriber Sensitive Data Exposure in WPPizza <= 3.19.9 versions. |
CVE-2026-34891 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce <= 2.2.5 versions. |
CVE-2026-24618 | Medium | 4.3 | 2026-06-12 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HashThemes Hash Elements allows Retrieve Embedded Sensitive Data.
… |
CVE-2026-0466 | Medium | 5.5 | 2026-06-09 | Improper access control in AMD uProf may allow a local attacker with user privileges to write to the kernel-shared memory section, potentially resulting in cra… |
CVE-2026-44743 | Low | 3.7 | 2026-06-09 | Under certain conditions, when an unauthorized attacker accesses a specific endpoint, SAP Business Objects application leaks sensitive information .This has a… |
CVE-2026-49077 | Medium | 5.3 | 2026-06-04 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tips and Tricks HQ WP eMember allows Retrieve Embedded Sensitive Da… |
CVE-2026-44749 | Medium | 4.3 | 2026-05-26 | The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revea… |
CVE-2018-25358 | High | 7.5 | 2026-05-23 | D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by manipulat… |
CVE-2026-27349 | Medium | 4.3 | 2026-05-21 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPFunnels Team Mail Mint allows Retrieve Embedded Sensitive Data.
… |
CVE-2026-0240 | High | 8.7 | 2026-05-13 | An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vaul… |
CVE-2026-0239 | Medium | 6.5 | 2026-05-13 | An information disclosure vulnerability in the Chronosphere Chronocollector enables an unauthenticated attacker with network access to the collector service to… |
CVE-2026-43654 | High | 7.5 | 2026-05-11 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, mac… |
CVE-2026-7864 | | | 2026-05-08 | SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the new GINA UI, allowing remot… |
CVE-2026-41928 | Medium | 5.3 | 2026-05-07 | Vvveb before 1.0.8.2 contains an information disclosure vulnerability in the cron controller that allows unauthenticated attackers to retrieve the application'… |
CVE-2026-42047 | High | 8.6 | 2026-05-07 | Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orchestration. Versions 3.22.0 through 3.53… |
CVE-2026-25468 | Medium | 5.3 | 2026-05-07 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs Happy Addons for Elementor allows Retrieve Embedded Sensitiv… |
CVE-2026-42644 | Medium | 5.3 | 2026-04-29 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper BetterDocs betterdocs allows Retrieve Embedded Sensitiv… |
CVE-2026-24222 | High | 8.6 | 2026-04-28 | NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by se… |
CVE-2026-41339 | Medium | 4.3 | 2026-04-23 | OpenClaw before 2026.4.2 exposes configPath and stateDir metadata in Gateway connect success snapshots to non-admin authenticated clients. Non-admin clients ca… |
CVE-2026-41335 | Medium | 5.3 | 2026-04-23 | OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent ide… |
CVE-2026-41459 | Medium | 5.3 | 2026-04-22 | Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full serv… |
CVE-2026-34413 | High | 8.6 | 2026-04-22 | Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/conne… |