Information disclosure.

FlexNet Beacon Missing Authentication Vulnerability

• Flexera FlexNet Beacon
• Flexera FlexNet Manager Suite
• Authentication bypass
• Information disclosure

BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

• BTCPay Server
• Hard-coded credentials
• Information disclosure

OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading

• openemr
• Information disclosure
• CWE-208

OpenEMR: Unauthenticated Information Disclosure in admin.php Exposes Database Names and Versions

• openemr
• Information disclosure
• Authentication bypass

OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot

• openemr
• Information disclosure

Observable discrepancy in OpenText Directory Services (OTDS)

• OpenText Directory Services (OTDS)
• Information disclosure

FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicing

• signalwire freeswitch
• Memory corruption
• Information disclosure

WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files

• wppconnect-server
• Information disclosure

Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9

• jreviews.com JReviews component for Joomla
• Information disclosure

OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)

• tinyhumansai openhuman
• Information disclosure

OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data

• tinyhumansai openhuman
• Information disclosure
• Authentication bypass

OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture

• tinyhumansai openhuman
• Broken access control
• Information disclosure

Apache OFBiz: Unauthenticated HR organization and employee disclosure

• Apache Software Foundation Apache OFBiz
• Information disclosure
• Broken access control

Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers

• Apache Software Foundation Apache OFBiz
• Information disclosure
• Broken access control

Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts

• Eclipse Foundation Eclipse BaSyx Helm Charts
• Information disclosure
• Hard-coded credentials

Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts

• Eclipse Foundation Eclipse BaSyx Helm Charts
• Information disclosure
• Hard-coded credentials

Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults

• Apache Software Foundation Apache Juneau
• Information disclosure

Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors

• Apache Software Foundation Apache Juneau
• Information disclosure

Sensitive information in error messages in Red Hat ansible-core

• Red Hat ansible-core
• Information disclosure

LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching

• litespeedtech LiteSpeed Cache
• Information disclosure

Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response

• parse-community parse-server
• Information disclosure

purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure

• purocean Yank Note
• Information disclosure
• Broken access control

NST Labs Tech Nstbrowser Local Agent API info information disclosure

• NST Labs Tech Nstbrowser
• Information disclosure
• Broken access control

Sandboxie-Plus: Sandbox containment bypass

• Sandboxie
• Information disclosure
• Broken access control

nvm prints the contents of any readable file through a symlinked .nvmrc

• nvm
• Path traversal
• Information disclosure

Multiple vulnerabilities that affects IBM Db2 Genius Hub

• IBM Db2 Genius Hub
• Information disclosure

Traccar: Authentication bypass via path parameters exposes protected device media

• traccar
• Information disclosure
• Authentication bypass

vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service

• vtenext
• Information disclosure

IBM MQ is affected by a pasword disclosure vulnerability in the runmqccred utility

• IBM MQ
• Information disclosure

Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References

• sensiolabs symfony
• Information disclosure
• Hard-coded credentials

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

• Information disclosure
• Broken access control

<0.0.0-20260610131716-5dc8f53b70a3 · fixed in 0.0.0-20260610131716-5dc8f53b70a3

Warpgate: Kubernetes listener discloses internal error text to an unauthenticated caller

• warp-tech warpgate
• Information disclosure

Information Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile application

• Tata Motors iRA 2.0
• Tata Motors iRA.ev
• Information disclosure

Apache OpenOffice: Local file inclusion via GStreamer plugin

• Apache Software Foundation Apache OpenOffice
• Information disclosure

Apache OpenOffice: Local file inclusion via SQL provider and flat file database references

• Apache Software Foundation Apache OpenOffice
• Information disclosure

WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability

• Doofinder for WooCommerce
• Information disclosure

Simple Download Monitor < 4.1.3 - Contributor+ Private Download Item Title and Description Disclosure via [sdm_show_download_info] Shortcode

• Simple Download Monitor
• Information disclosure

EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override

• EventPrime
• Information disclosure

Premium Packages < 7.3.1 - Unauthenticated Cross-User Saved Cart Disclosure via IDOR

• Premium Packages
• Information disclosure

Duplicator 5.0.0 - 5.0.6 - Unauthenticated Full Path Disclosure via Installer Entry Points

• Duplicator
• duplicator-pro
• Information disclosure

WP Remote Users Sync < 2.2.0 - Unauthenticated Sensitive Data Disclosure via Public User Export File

• WP Remote Users Sync
• Information disclosure

Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure

• Post Duplicator
• Information disclosure

WP ERP < 1.17.11 - Subscriber+ Sensitive Data Disclosure via Audit Log

• ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
• Information disclosure

Linksys E5600 Factory Quality Control fqc.cgi information disclosure

• Linksys E5600
• Information disclosure
• Broken access control

MailEnable Auth Cleartext Storage Information Disclosure Vulnerability

• MailEnable
• Information disclosure

Tanium addressed an information disclosure vulnerability in Discover.

• Tanium Discover
• Information disclosure

Tanium addressed an information disclosure vulnerability in Discover.

• Tanium Discover
• Information disclosure

Resource exposure in Google Chrome

• Google Chrome
• Information disclosure

Observable discrepancy in Google Chrome

• Google Chrome
• Information disclosure

Observable discrepancy in Google Chrome

• Google Chrome
• Information disclosure

Resource exposure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Observable discrepancy in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Observable discrepancy in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure