# Information disclosure. Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WordPress Five Star Restaurant Reservations plugin <= 2.7.24 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-103334.md) `CVE-2026-103334` · CVE record: Etoile Web Design Incorporated Five Star Restaurant Reservations · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure - [Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token](https://agentprime.io/advisories/CVE-2026-105635.md) `CVE-2026-105635` · CVE record: makeplane plane · CVSS 7.4 High · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Broken access control - [SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)](https://agentprime.io/advisories/GHSA-4wwp-f6gw-6qm5.md) `GHSA-4wwp-f6gw-6qm5`, `CVE-2026-85175`, `GO-2026-6663` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260819144130-256d73aa7f94`, fixed in `0.0.0-20260819144130-256d73aa7f94` · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure - [SiYuan: /history/\*path and /repo/diff/\*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/\*](https://agentprime.io/advisories/GHSA-3cm4-ccvw-6xr6.md) `GHSA-3cm4-ccvw-6xr6`, `CVE-2026-82651`, `GO-2026-6662` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260816034002-035bf9a8c311`, fixed in `0.0.0-20260816034002-035bf9a8c311` · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Broken access control - [Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member](https://agentprime.io/advisories/CVE-2026-104963.md) `CVE-2026-104963` · CVE record: makeplane plane · CVSS 4.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Broken access control - [WordPress WP Event Solution plugin <= 4.1.25 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-105073.md) `CVE-2026-105073` · CVE record: Arraytics WP Event Solution · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure - [Environment/ini-file leaks](https://agentprime.io/advisories/CVE-2026-63270.md) `CVE-2026-63270` · CVE record: The Document Foundation LibreOffice · CVSS 6.7 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure - [LFI and GET SSRF via GStreamer and HLS playlists](https://agentprime.io/advisories/CVE-2026-63269.md) `CVE-2026-63269` · CVE record: The Document Foundation LibreOffice · CVSS 6.7 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Server-side request forgery (SSRF) - [LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href](https://agentprime.io/advisories/CVE-2026-63268.md) `CVE-2026-63268` · CVE record: The Document Foundation LibreOffice · CVSS 6.7 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure - [LFI and GET SSRF via calcext:data-mappings and csv provider](https://agentprime.io/advisories/CVE-2026-63267.md) `CVE-2026-63267` · CVE record: The Document Foundation LibreOffice · CVSS 6.7 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Server-side request forgery (SSRF) - [WordPress Video Conferencing with Zoom plugin <= 4.6.10 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-103335.md) `CVE-2026-103335` · CVE record: Deepen Bajracharya Video Conferencing with Zoom · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure - [WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-105068.md) `CVE-2026-105068` · CVE record: Pixelite Events Manager · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure - [WordPress Memberful - Membership Plugin plugin <= 1.81.2 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-104401.md) `CVE-2026-104401` · CVE record: Memberful Memberful - Membership Plugin · CVSS 4.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure - [Files accessible to external parties in GROWI](https://agentprime.io/advisories/CVE-2026-100727.md) `CVE-2026-100727` · CVE record: GROWI, Inc. GROWI · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure - [Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens](https://agentprime.io/advisories/CVE-2026-105302.md) `CVE-2026-105302` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 5.7 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure - [WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-104402.md) `CVE-2026-104402` · CVE record: farvisun Mindio Magic MCP · CVSS 4.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Information disclosure - [ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode](https://agentprime.io/advisories/CVE-2026-105211.md) `CVE-2026-105211` · CVE record: zitadel zitadel · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Information disclosure - [SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo](https://agentprime.io/advisories/CVE-2026-105205.md) `CVE-2026-105205` · CVE record: siyuan-note siyuan · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Information disclosure - [WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-97307.md) `CVE-2026-97307` · CVE record: StylemixThemes Cost Calculator Builder · CVSS 7.5 High · Not analysed yet · Published 4 Oct 2026 · Tags: Information disclosure - [Weaviate Verba generate_stream Endpoint util.py get_environment information disclosure](https://agentprime.io/advisories/CVE-2026-105145.md) `CVE-2026-105145` · CVE record: Weaviate Verba · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Information disclosure, Broken access control - [Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback](https://agentprime.io/advisories/CVE-2026-86817.md) `CVE-2026-86817` · CVE record: Unknown Five Star Business Profile and Schema · CVSS 4.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Information disclosure - [Omega Solution CoinEx Crypto Support Ticket API customer information disclosure](https://agentprime.io/advisories/CVE-2026-105098.md) `CVE-2026-105098` · CVE record: Omega Solution CoinEx Crypto · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Information disclosure, Broken access control - [OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint](https://agentprime.io/advisories/CVE-2026-105120.md) `CVE-2026-105120` · CVE record: OpenIdentityPlatform OpenAM · CVSS 6.9 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Information disclosure - [Native AES packet cipher returns the raw AES key on an alias](https://agentprime.io/advisories/CVE-2026-71883.md) `CVE-2026-71883` · CVE record: Legion of the Bouncy Castle Inc. BC-LTS-JAVA · CVSS 8.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: Information disclosure - [Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code](https://agentprime.io/advisories/CVE-2026-96962.md) `CVE-2026-96962` · CVE record: Unknown Pie Register · CVSS 3.7 Low · Not analysed yet · Published 3 Oct 2026 · Tags: Information disclosure - [MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration](https://agentprime.io/advisories/CVE-2026-86834.md) `CVE-2026-86834` · CVE record: Unknown MetForm · CVSS 3.7 Low · Not analysed yet · Published 3 Oct 2026 · Tags: Information disclosure - [MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API](https://agentprime.io/advisories/CVE-2026-86832.md) `CVE-2026-86832` · CVE record: Unknown MetForm · CVSS 5.3 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Information disclosure - [WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path](https://agentprime.io/advisories/CVE-2026-80518.md) `CVE-2026-80518` · CVE record: Unknown WP Ultimate CSV Importer · CVSS 3.7 Low · Not analysed yet · Published 3 Oct 2026 · Tags: Information disclosure - [WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signa…](https://agentprime.io/advisories/CVE-2026-100149.md) `CVE-2026-100149` · CVE record: wpzoom WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons · CVSS 5.3 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Information disclosure - [Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API](https://agentprime.io/advisories/CVE-2026-105030.md) `CVE-2026-105030` · CVE record: rajnandan1 kener · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive](https://agentprime.io/advisories/CVE-2026-104476.md) `CVE-2026-104476` · CVE record: backdrop backdrop · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values](https://agentprime.io/advisories/GHSA-fj2x-mqqp-3v2w.md) `GHSA-fj2x-mqqp-3v2w`, `CVE-2026-114073` · npm `trigger.dev`: affected `<4.5.9`, fixed in `4.5.9` · CVSS 6.8 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain](https://agentprime.io/advisories/GHSA-v2f8-6655-7grj.md) `GHSA-v2f8-6655-7grj`, `CVE-2026-114108` · PyPI `vibe-trading-ai`: affected `>=0.1.0, <0.1.7`, fixed in `0.1.7` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure, Authentication bypass, Unrestricted file upload, Broken access control - [Vibe-Trading file-read tools expose arbitrary server-readable files](https://agentprime.io/advisories/GHSA-5rmq-chc7-m22f.md) `GHSA-5rmq-chc7-m22f`, `CVE-2026-114106` · PyPI `vibe-trading-ai`: affected `>=0.1.0, <0.1.7`, fixed in `0.1.7` · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Path traversal, Information disclosure - [Trigger.dev: V1 coordinator default-secret unauth Socket.IO](https://agentprime.io/advisories/GHSA-gg6r-gp4c-89hp.md) `GHSA-gg6r-gp4c-89hp`, `CVE-2026-114088` · npm `trigger.dev`: affected `<4.5.4`, fixed in `4.5.4` · CVSS 8.3 High · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure, Hard-coded credentials, Broken access control - [Armatura LLC Armatura One Insertion of Sensitive Information into Log File](https://agentprime.io/advisories/CVE-2026-94593.md) `CVE-2026-94593` · CVE record: Armatura LLC Armatura One and 1 more · CVSS 8.5 High · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [Armatura LLC Armatura One Insertion of Sensitive Information into Log File](https://agentprime.io/advisories/CVE-2026-94594.md) `CVE-2026-94594` · CVE record: Armatura LLC Armatura One and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm](https://agentprime.io/advisories/CVE-2026-104055.md) `CVE-2026-104055` · CVE record: Canonical postgresql-operator · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [RPC secret disclosure via vendor data endpoint in Canonical MAAS](https://agentprime.io/advisories/CVE-2026-12392.md) `CVE-2026-12392` · CVE record: Canonical MAAS · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [Server-side request forgery in the OAuth2 discovery handling in Loom for AWS](https://agentprime.io/advisories/CVE-2026-103957.md) `CVE-2026-103957` · CVE record: AWS loom · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure, Server-side request forgery (SSRF) - [Information disclosure in Google Chrome](https://agentprime.io/advisories/CVE-2026-103627.md) `CVE-2026-103627` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [WordPress Smart One Click Setup – Complete Demo Import \& Export plugin <= 1.4.3 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-32584.md) `CVE-2026-32584` · CVE record: Chiranjit Hazarika Smart One Click Setup – Complete Demo Import \& Export · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [User Enumeration in Softtr's E-Commerce Pack](https://agentprime.io/advisories/CVE-2026-11795.md) `CVE-2026-11795` · CVE record: Softtr Informatics Trading Limited Company E-Commerce Pack · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action](https://agentprime.io/advisories/CVE-2026-104455.md) `CVE-2026-104455` · CVE record: YesWiki yeswiki · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo](https://agentprime.io/advisories/CVE-2026-103763.md) `CVE-2026-103763` · CVE record: siyuan-note siyuan · CVSS 6.9 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget](https://agentprime.io/advisories/CVE-2026-102002.md) `CVE-2026-102002` · CVE record: themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE · CVSS 3.1 Low · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap](https://agentprime.io/advisories/CVE-2026-63573.md) `CVE-2026-63573` · CVE record: Legion of the Bouncy Castle Inc. bc-csharp · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)](https://agentprime.io/advisories/CVE-2026-63567.md) `CVE-2026-63567` · CVE record: Legion of the Bouncy Castle Inc. bc-csharp · CVSS 8.2 High · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page](https://agentprime.io/advisories/CVE-2026-97317.md) `CVE-2026-97317` · CVE record: Unknown Giveaways and Contests by RafflePress · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum](https://agentprime.io/advisories/CVE-2026-90988.md) `CVE-2026-90988` · CVE record: Unknown Request a Quote · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure - [GV-Eye Relay Payment API Key Vulnerability](https://agentprime.io/advisories/CVE-2026-103097.md) `CVE-2026-103097` · CVE record: GeoVision Inc. GV-Eye · CVSS 7.5 High · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure, Hard-coded credentials, CWE-540 - [GV-Eye Hardcoded API Key Vulnerability](https://agentprime.io/advisories/CVE-2026-103096.md) `CVE-2026-103096` · CVE record: GeoVision Inc. GV-Eye · CVSS 7.5 High · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure, Hard-coded credentials, CWE-540 - [Information disclosure in Johnson Controls Easy IO Neo](https://agentprime.io/advisories/CVE-2026-64892.md) `CVE-2026-64892` · CVE record: Johnson Controls Easy IO Neo · CVSS 6.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure - [Rubygem-katello: improper authorization logic allows resource enumeration](https://agentprime.io/advisories/CVE-2026-56098.md) `CVE-2026-56098` · CVE record: Red Hat Red Hat Satellite 6.16 for RHEL 8 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure - [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67172.md) `CVE-2026-67172` · CVE record: HCL Software HCL BigFix Service Management · CVSS 3.7 Low · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure - [HCL BigFix Service Management is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67171.md) `CVE-2026-67171` · CVE record: HCL Software HCL BigFix Service Management · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure - [Apache HTTP Server: mod_dav_fs property database read access](https://agentprime.io/advisories/CVE-2026-58415.md) `CVE-2026-58415` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure - [Apache HTTP Server: mod_session: Session cookie not removed during internal redirect](https://agentprime.io/advisories/CVE-2026-47360.md) `CVE-2026-47360` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure - [Information disclosure in Eclipse Foundation Eclipse BaSyx AAS Web UI](https://agentprime.io/advisories/CVE-2026-101322.md) `CVE-2026-101322` · CVE record: Eclipse Foundation Eclipse BaSyx AAS Web UI · CVSS 8.3 High · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure - [vm2 exposes host HTTPS credentials and TLS traffic through globalAgent](https://agentprime.io/advisories/GHSA-h85j-hv3c-qfgq.md) `GHSA-h85j-hv3c-qfgq`, `CVE-2026-92940` · npm `vm2`: affected `>=3.11.3, <3.11.7`, fixed in `3.11.7` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Information disclosure Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .