# Information disclosure. Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Exposure of sensitive information in Progress MarkLogic Server](https://agentprime.io/advisories/CVE-2026-85966.md) `CVE-2026-85966` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 7.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [Sensitive information exposure in Progress MarkLogic Server Azure deployments](https://agentprime.io/advisories/CVE-2026-85961.md) `CVE-2026-85961` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 7.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations](https://agentprime.io/advisories/CVE-2026-109341.md) `CVE-2026-109341` · CVE record: surrealdb surrealdb · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause](https://agentprime.io/advisories/CVE-2026-109337.md) `CVE-2026-109337` · CVE record: surrealdb surrealdb · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields](https://agentprime.io/advisories/CVE-2026-109335.md) `CVE-2026-109335` · CVE record: surrealdb surrealdb · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [Grav from 2.0.22 before 2.1.7 Clockwork Profiler Authentication Bypass via Proxy](https://agentprime.io/advisories/CVE-2026-109325.md) `CVE-2026-109325` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [Grav 2.0.22 before 2.1.7 Clockwork Debugger Token Disclosure via Twig Sandbox](https://agentprime.io/advisories/CVE-2026-109315.md) `CVE-2026-109315` · CVE record: getgrav grav · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [Grav Login Plugin 1.2.0 before 3.9.9 Password Reset Token Disclosure via Reset Page](https://agentprime.io/advisories/CVE-2026-109314.md) `CVE-2026-109314` · CVE record: getgrav grav-plugin-login · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 Arbitrary File Read via Twig create() DOMDocument](https://agentprime.io/advisories/CVE-2026-109304.md) `CVE-2026-109304` · CVE record: craftcms cms · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [Open WebUI 0.11.0 before 0.11.4 Tool Source Disclosure via Tool Export Endpoint](https://agentprime.io/advisories/CVE-2026-109293.md) `CVE-2026-109293` · CVE record: open-webui open-webui · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode Connections](https://agentprime.io/advisories/CVE-2026-109292.md) `CVE-2026-109292` · CVE record: open-webui open-webui · CVSS 7.6 High · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Information Disclosure in TGA Decoder](https://agentprime.io/advisories/CVE-2026-109259.md) `CVE-2026-109259` · CVE record: ImageMagick ImageMagick · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [Sensitive information exposure in Progress MarkLogic Server trace logs](https://agentprime.io/advisories/CVE-2026-85949.md) `CVE-2026-85949` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 8.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [Internal error terms inspected into AshTypescript RPC error responses](https://agentprime.io/advisories/GHSA-7gxc-w225-f7f3.md) `GHSA-7gxc-w225-f7f3`, `CVE-2026-105283`, `EEF-CVE-2026-105283` · Hex `ash_typescript`: affected `>=0.1.0, <0.19.1`, fixed in `0.19.1` · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [WordPress Booster Elite for WooCommerce plugin < 8.4.0 - Authenticated Arbitrary WordPress Option Disclosure vulnerability](https://agentprime.io/advisories/CVE-2023-25996.md) `CVE-2023-25996` · CVE record: Pluggabl LLC. Booster Elite for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [WMCMS index.php information disclosure](https://agentprime.io/advisories/CVE-2026-108811.md) `CVE-2026-108811` · CVE record: WMCMS · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure, Broken access control - [tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure](https://agentprime.io/advisories/CVE-2026-108810.md) `CVE-2026-108810` · CVE record: tsi-coop tsi-dpdp-cms · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure, Broken access control - [Unauthenticated Disclosure of Agent Frontend Configuration](https://agentprime.io/advisories/CVE-2026-78356.md) `CVE-2026-78356` · CVE record: OTRS GmbH (former OTRS AG) OTRS · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure - [Channel tokens and organization API key exposed in API responses](https://agentprime.io/advisories/CVE-2026-107761.md) `CVE-2026-107761` · CVE record: GitroomHQ postiz-app · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Information disclosure, CWE-213 - [Odoo MCP 1.0.0 through 1.3.2 Information Disclosure via execute_method Tool](https://agentprime.io/advisories/CVE-2026-108861.md) `CVE-2026-108861` · CVE record: erpipe-org Odoo MCP · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Information disclosure - [Predibase LoRAX through 0.12.1 API Token Exposure via Router Logs](https://agentprime.io/advisories/CVE-2026-108858.md) `CVE-2026-108858` · CVE record: Predibase LoRAX · CVSS 6.8 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Information disclosure - [Hugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging](https://agentprime.io/advisories/CVE-2026-108857.md) `CVE-2026-108857` · CVE record: Hugging Face Text Embeddings Inference · CVSS 4.8 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Information disclosure - [Neterbit NW-431F Embedded Web Server sms.json information disclosure](https://agentprime.io/advisories/CVE-2026-108578.md) `CVE-2026-108578` · CVE record: Neterbit NW-431F · CVSS 6.9 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Information disclosure, Broken access control - [GPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger](https://agentprime.io/advisories/CVE-2026-108754.md) `CVE-2026-108754` · CVE record: tbphp gpt-load · CVSS 4.8 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Information disclosure - [Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook](https://agentprime.io/advisories/CVE-2026-108728.md) `CVE-2026-108728` · CVE record: flyteorg flyte · CVSS 7.1 High · Not analysed yet · Published 11 Oct 2026 · Tags: Information disclosure - [WP-Invoice <= 4.3.1 - Subscriber+ User PII Disclosure via Unprotected AJAX Handlers](https://agentprime.io/advisories/CVE-2026-97183.md) `CVE-2026-97183` · CVE record: Unknown WP-Invoice · CVSS 4.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Information disclosure - [Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String](https://agentprime.io/advisories/CVE-2026-88785.md) `CVE-2026-88785` · CVE record: Unknown Simple Membership · CVSS 4.7 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Information disclosure - [Dokan < 5.2.0 - Vendor+ Cross-Vendor Commission Settings Disclosure via Commission REST Endpoint](https://agentprime.io/advisories/CVE-2026-107694.md) `CVE-2026-107694` · CVE record: Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution · CVSS 2.7 Low · Not analysed yet · Published 11 Oct 2026 · Tags: Information disclosure - [Envira Gallery < 1.16.2 - Author+ Non-Public Post Title and Excerpt Disclosure via Gallery REST Field](https://agentprime.io/advisories/CVE-2026-104681.md) `CVE-2026-104681` · CVE record: Unknown Envira Gallery · CVSS 2.7 Low · Not analysed yet · Published 11 Oct 2026 · Tags: Information disclosure - [WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-66480.md) `CVE-2026-66480` · CVE record: YITH YITH WooCommerce Product Add-Ons · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Information disclosure - [WordPress Contact Form 7 – Dynamic Text Extension plugin <= 5.0.7 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-62043.md) `CVE-2026-62043` · CVE record: sevenspark Contact Form 7 – Dynamic Text Extension · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2026 · Tags: Information disclosure - [WordPress Web Plura Backup & Restore Manager plugin <= 0.2.25 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-42630.md) `CVE-2026-42630` · CVE record: Web Plura Web Plura Backup \& Restore Manager · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2026 · Tags: Information disclosure - [WordPress Swish Migrate and Backup plugin <= 1.4.0 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-42419.md) `CVE-2026-42419` · CVE record: SwishFolio Swish Migrate and Backup · CVSS 5.9 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Information disclosure - [WordPress WP Rollback plugin <= 3.1.2 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-66435.md) `CVE-2026-66435` · CVE record: Devin Walker WP Rollback · CVSS 5.9 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Information disclosure - [Booking Package < 1.7.30 - Unauthenticated Booking Customer PII Disclosure](https://agentprime.io/advisories/CVE-2026-105995.md) `CVE-2026-105995` · CVE record: Unknown Booking Package · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Information disclosure - [Accept PayPal Payments Using Contact Form 7 < 4.0.7 - Unauthenticated PII Disclosure via CSV Export](https://agentprime.io/advisories/CVE-2026-105990.md) `CVE-2026-105990` · CVE record: Unknown Accept PayPal Payments using Contact Form 7 · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Information disclosure - [Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()](https://agentprime.io/advisories/CVE-2026-94375.md) `CVE-2026-94375` · CVE record: webtoffee Order Export & Order Import for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Information disclosure - [Booking Calendar <= 11.4.3 - Unauthenticated Sensitive Information Exposure in 'WPBC_FLEXTIMELINE_NAV' AJAX Action](https://agentprime.io/advisories/CVE-2026-18496.md) `CVE-2026-18496` · CVE record: wpdevelop Booking Calendar · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Information disclosure - [Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email](https://agentprime.io/advisories/CVE-2026-103964.md) `CVE-2026-103964` · CVE record: codename065 Download Manager · CVSS 4.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Information disclosure - [Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details](https://agentprime.io/advisories/CVE-2026-103365.md) `CVE-2026-103365` · CVE record: ladela Online Scheduling and Appointment Booking System – Bookly · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Information disclosure - [Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint](https://agentprime.io/advisories/GHSA-8wvg-r2j4-3737.md) `GHSA-8wvg-r2j4-3737`, `GO-2026-6723` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure - [Vikunja: Cross-project task disclosure through subtask expansion](https://agentprime.io/advisories/GHSA-3hc7-r24j-rpwc.md) `GHSA-3hc7-r24j-rpwc`, `GO-2026-6714` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control - [Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled](https://agentprime.io/advisories/GHSA-x2rp-9qf7-2fmq.md) `GHSA-x2rp-9qf7-2fmq`, `CVE-2026-107842`, `PKSA-bmqh-y7sv-p1st` · Packagist `contao/core-bundle`: affected `>=4.0.0, <5.3.50 || >=5.4.0-RC1, <5.7.12`, fixed in `5.3.50`, `5.7.12` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure - [Vikunja: Link-share token can enumerate users through the v2 API](https://agentprime.io/advisories/GHSA-vfxw-3x8p-2vjr.md) `GHSA-vfxw-3x8p-2vjr`, `CVE-2026-91981`, `GO-2026-6752` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control - [Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project](https://agentprime.io/advisories/GHSA-39p5-2wrr-xh29.md) `GHSA-39p5-2wrr-xh29`, `CVE-2026-91980`, `GO-2026-6713` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control - [Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level](https://agentprime.io/advisories/GHSA-qfwc-vx6f-3g6g.md) `GHSA-qfwc-vx6f-3g6g`, `CVE-2026-91985`, `GO-2026-6747` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 8.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control - [Vikunja: TOTP secret is readable after enrollment, no step-up auth](https://agentprime.io/advisories/GHSA-88f6-4rjv-x774.md) `GHSA-88f6-4rjv-x774`, `CVE-2026-91982`, `GO-2026-6722` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Hard-coded credentials - [Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access](https://agentprime.io/advisories/GHSA-r6w9-259g-gwrv.md) `GHSA-r6w9-259g-gwrv`, `CVE-2026-62376`, `GO-2026-6748` · Go `code.vikunja.io/api`: affected `<2.4.0`, fixed in `2.4.0` · CVSS 8.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Weak cryptography or TLS - [Mindwtr: Cloud token and WebDAV password stored in plaintext on mobile](https://agentprime.io/advisories/CVE-2026-107857.md) `CVE-2026-107857` · CVE record: dongdongbh Mindwtr · CVSS 4.4 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Hard-coded credentials - [0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser](https://agentprime.io/advisories/GHSA-32gc-wf3m-78w9.md) `GHSA-32gc-wf3m-78w9`, `CVE-2026-107811`, `GO-2026-6702` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728091109-0ecbd106c37b`, fixed in `1.9.10-0.20260728091109-0ecbd106c37b` · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control - [Nginx UI: Node Secret Credential Exposure via URL Query Parameter](https://agentprime.io/advisories/GHSA-pvgv-gcp7-v38g.md) `GHSA-pvgv-gcp7-v38g`, `CVE-2026-107807`, `GO-2026-6708` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b`, fixed in `1.9.10-0.20260728074433-a3999bd78a3b` · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, CWE-598 - [pyLoad: Unauthenticated access to /web/\ bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo](https://agentprime.io/advisories/GHSA-j92p-c242-7hfx.md) `GHSA-j92p-c242-7hfx`, `CVE-2026-75597`, `PYSEC-2026-4292` · PyPI `pyload-ng`: affected `<0.5.0b3.dev101`, fixed in `0.5.0b3.dev101` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Authentication bypass - [Insertion of sensitive information into log file in AWS Tools for PowerShell](https://agentprime.io/advisories/CVE-2026-107783.md) `CVE-2026-107783` · CVE record: AWS aws-tools-for-powershell · CVSS 6.7 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure - [WordPress QA Analytics plugin <= 5.3.0.0 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-105877.md) `CVE-2026-105877` · CVE record: QuarkA QA Analytics · CVSS 6.9 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure - [WordPress All Bootstrap Blocks plugin <= 1.3.31 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-62036.md) `CVE-2026-62036` · CVE record: AREOI All Bootstrap Blocks · CVSS 4.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure - [Sensitive information in error messages in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-78021.md) `CVE-2026-78021` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 3.7 Low · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure - [SendPress <= 1.26.1.20 - Unauthenticated Newsletter Sending Log Disclosure via Hardcoded Token](https://agentprime.io/advisories/CVE-2026-92990.md) `CVE-2026-92990` · CVE record: Unknown SendPress Newsletters · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure - [Ops Manager Sensitive MFA Enrollment Information Exposure in User Listings](https://agentprime.io/advisories/CVE-2026-87109.md) `CVE-2026-87109` · CVE record: MongoDB Ops Manager · CVSS 6.0 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure - [An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to obtain sensitive information](https://agentprime.io/advisories/CVE-2026-78795.md) `CVE-2026-78795` · CVE record · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure - [Azure API Center Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-83943.md) `CVE-2026-83943` · CVE record: Microsoft Azure API Center · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .