CVE-2026-110466 | Medium | 4.3 | 2026-10-14 | Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and o… |
CVE-2026-97740 | Medium | 6.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information ov… |
CVE-2026-96948 | Medium | 5.5 | 2026-10-13 | Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose informatio… |
CVE-2026-96935 | Medium | 5.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2026-96865 | Medium | 5.6 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information… |
CVE-2026-85866 | Medium | 4.7 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally. |
CVE-2026-85793 | Medium | 5.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Service allows an authorized attacker to disclose information loc… |
CVE-2026-83925 | Medium | 4.7 | 2026-10-13 | Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-83909 | Medium | 4.7 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose informat… |
CVE-2026-83907 | Medium | 5.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally. |
CVE-2026-83905 | Medium | 4.7 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally. |
CVE-2026-83897 | Medium | 4.7 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose informat… |
CVE-2026-83893 | Medium | 5.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows Clipboard User Service allows an authorized attacker to disclose informat… |
CVE-2026-83835 | Medium | 5.5 | 2026-10-13 | Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally. |
CVE-2026-83774 | Medium | 4.7 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose informat… |
CVE-2026-83773 | Medium | 5.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information… |
CVE-2026-83713 | Medium | 5.5 | 2026-10-13 | Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally. |
CVE-2026-83705 | Medium | 5.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally. |
CVE-2026-83672 | Medium | 4.7 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allows an authorized attacker to disclose information locally. |
CVE-2026-70261 | Medium | 5.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information… |
CVE-2026-70260 | Medium | 5.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information… |
CVE-2026-70232 | Medium | 5.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-70199 | Medium | 5.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-70055 | Medium | 5.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services allows an authorized attacker to disclose informat… |
CVE-2026-69644 | Medium | 5.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows iSCSI allows an authorized attacker to disclose information locally. |
CVE-2026-108462 | Medium | 5.5 | 2026-10-13 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-78356 | Medium | 5.3 | 2026-10-12 | The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal applicatio… |
CVE-2026-66480 | Medium | 5.3 | 2026-10-10 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sens… |
CVE-2026-62036 | Medium | 4.3 | 2026-10-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Emb… |
CVE-2026-106106 | | | 2026-10-06 | Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, rende… |
CVE-2026-102387 | High | 7.5 | 2026-10-06 | Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions. |
CVE-2026-105073 | Medium | 5.3 | 2026-10-05 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embed… |
CVE-2026-104401 | Medium | 4.3 | 2026-10-05 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retriev… |
CVE-2026-97181 | Medium | 5.3 | 2026-09-24 | GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs. |
CVE-2026-84712 | Medium | 5.3 | 2026-09-23 | A flaw was found in the automation-controller API. The
unauthenticated health-check endpoint /api/v2/ping/
(ApiV2PingView… |
CVE-2026-95600 | Medium | 5.3 | 2026-09-23 | Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions. |
CVE-2025-33141 | Medium | 6.5 | 2026-09-18 | IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permis… |
CVE-2026-27553 | Medium | 6.5 | 2026-09-16 | A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user co… |
CVE-2026-38058 | High | 8.1 | 2026-09-11 | The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt pass… |
CVE-2026-61911 | Medium | 4.3 | 2026-09-09 | An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed… |
CVE-2026-81394 | Medium | 5.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information lo… |
CVE-2026-81387 | Medium | 5.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information lo… |
CVE-2026-71330 | High | 7.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to dis… |
CVE-2026-69832 | Medium | 5.6 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally. |
CVE-2026-69723 | Medium | 5.7 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information over a netwo… |
CVE-2026-69406 | Medium | 5.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-69339 | Medium | 5.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information… |
CVE-2026-69315 | Medium | 5.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows License Manager allows an authorized attacker to disclose information loc… |
CVE-2026-68842 | Medium | 5.5 | 2026-09-08 | Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information… |
CVE-2026-16006 | | | 2026-09-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virtual addresses via a… |
CVE-2026-76968 | Medium | 6.5 | 2026-09-08 | SAP Web Dispatcher, Internet Communication Manager and SAP Content Server allows an authenticated low-privileged attacker to access certain administrative func… |
CVE-2026-80119 | High | 7.8 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vu… |
CVE-2026-80118 | High | 7.1 | 2026-09-04 | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an unauthenticated physical… |
CVE-2026-66840 | High | 7.5 | 2026-09-04 | XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked. |
CVE-2026-81774 | High | 7.5 | 2026-09-02 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product Attachment woo-product-attachment allo… |
CVE-2026-53682 | Medium | 5.3 | 2026-09-01 | An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating int… |
CVE-2026-78268 | High | 7.5 | 2026-08-24 | Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versi… |
CVE-2026-75928 | Medium | 5.3 | 2026-08-21 | The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unau… |
CVE-2026-67267 | Medium | 5.5 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. A low… |
CVE-2026-74007 | Medium | 5.3 | 2026-08-18 | Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions. |
CVE-2026-32468 | High | 7.5 | 2026-08-18 | Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions. |
CVE-2024-58375 | High | 7.5 | 2026-08-16 | OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, v… |
CVE-2026-66462 | High | 7.5 | 2026-08-13 | Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions. |
CVE-2026-66444 | Medium | 6.5 | 2026-08-13 | Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions. |
CVE-2025-15680 | | | 2026-08-10 | TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device's circuit board without sufficient protection. A physically proximate attacker can connect… |
CVE-2026-6373 | Medium | 6.5 | 2026-08-10 | Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting.
This… |
CVE-2026-69127 | | | 2026-08-07 | Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error mes… |
CVE-2026-17595 | Low | 2.7 | 2026-08-07 | Nexus Repository 3 did not fully sandbox JEXL expressions used in Content Selectors. An account holding the nexus:selectors:create permission could construct a… |
CVE-2026-28169 | Medium | 5.3 | 2026-08-06 | Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier <= 2.52.0 versions. |
CVE-2026-44945 | Critical | 9.1 | 2026-08-05 | A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the de… |
CVE-2026-56569 | Medium | 4.0 | 2026-07-31 | HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web serve… |
CVE-2026-58246 | Medium | 4.3 | 2026-07-28 | SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated… |
CVE-2026-66438 | Medium | 5.3 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions. |
CVE-2026-65564 | Medium | 5.3 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions. |
CVE-2026-59548 | High | 7.5 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions. |
CVE-2026-59528 | High | 7.5 | 2026-07-27 | Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions. |
CVE-2025-59178 | | | 2026-07-27 | Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allo… |
CVE-2026-44955 | Medium | 5.3 | 2026-07-23 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could all… |
CVE-2026-28698 | High | 8.6 | 2026-07-23 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could exp… |
CVE-2026-65535 | Medium | 4.3 | 2026-07-23 | Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions. |
CVE-2026-65521 | Medium | 5.3 | 2026-07-23 | Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions. |
CVE-2026-65505 | Medium | 5.3 | 2026-07-23 | Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions. |
CVE-2026-65498 | Medium | 5.3 | 2026-07-23 | Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions. |
CVE-2026-65490 | Medium | 5.3 | 2026-07-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in John-Michael L'Allier Create mediavine-create allows Retrieve Embed… |
CVE-2026-65474 | Medium | 5.3 | 2026-07-23 | Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions. |
CVE-2026-65458 | Medium | 4.3 | 2026-07-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Se… |
CVE-2026-61945 | Medium | 6.5 | 2026-07-23 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedd… |
CVE-2023-37507 | High | 7.5 | 2026-07-21 | HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed. |
CVE-2026-16072 | Medium | 4.9 | 2026-07-17 | A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitati… |
CVE-2026-10588 | Medium | 4.4 | 2026-07-16 | A potential vulnerability could allow a local privileged attacker to disclose the address of protected System Management Mode memory. |
CVE-2026-50294 | Medium | 6.2 | 2026-07-14 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally. |
CVE-2026-61977 | Medium | 5.3 | 2026-07-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive… |
CVE-2026-61976 | Medium | 5.3 | 2026-07-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embed… |
CVE-2026-61975 | Medium | 5.3 | 2026-07-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitiv… |
CVE-2026-57393 | Medium | 6.5 | 2026-07-13 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder… |
CVE-2026-14808 | Critical | 9.8 | 2026-07-06 | Prog
Management System developed by PROG MIS has a Exposure of Sensitive
Information vulnerability, allowing unauthenticated remote attackers to view
a s… |
CVE-2026-55726 | Medium | 5.3 | 2026-07-03 | The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user would be able to access any device l… |
CVE-2026-57753 | Medium | 5.3 | 2026-07-02 | Unauthenticated Sensitive Data Exposure in Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 versions. |
CVE-2026-56124 | High | 7.5 | 2026-06-29 | phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploa… |
CVE-2026-57664 | Medium | 4.3 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in Bopo – WooCommerce Product Bundle Builder <= 1.1.6 versions. |