Information disclosure.

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Observable discrepancy in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure

• AcademySoftwareFoundation openexr
• Information disclosure
• Memory corruption

phpMyFAQ public FAQ APIs expose inactive FAQ content

• Information disclosure
• Broken access control

>=4.1.0, <4.1.5 · fixed in 4.1.5

urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage

• Information disclosure
• Hard-coded credentials

<2.44.1 || >=3.0.0, <4.9.1 · fixed in 2.44.1, 4.9.1

rclone before 1.75.0 Authentication Bypass via pprof

• rclone
• Information disclosure

HCL Hive is affected by multiple security vulnerabilities.

• HCL Software Hive
• Information disclosure

Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)

• Information disclosure

>=4.0.0, <5.3.50 || >=5.4.0, <5.7.12 · fixed in 5.3.50, 5.7.12

Duplicate Advisory: Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths

• Information disclosure

* · no fixed version yet

Grav Login Plugin before 3.9.1 Email Enumeration via Registration

• getgrav grav-plugin-login
• Information disclosure

WordPress Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads plugin <= 1.2.0 - Sensitive Data Exposure vulnerability

• Extend Themes Lead Generation Contact Widget &amp; AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads
• Information disclosure

RansomLook API Key Disclosure Through /admin/apikeys HTML Source

• ransomlook
• Information disclosure
• Hard-coded credentials

Apache Allura: Unauthenticated REST disclosure

• Apache Software Foundation Apache Allura
• Information disclosure

Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder

• zephyr
• Information disclosure

Unauthenticated Disclosure of Scraping Credentials and Bypass Configuration via RansomLook API

• ransomlook
• Information disclosure

Redis Glob Pattern Injection Allows Unauthorized Enumeration of Private Ransomlook Data

• ransomlook
• Information disclosure

WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability

• WPCafe WP Cafe Pro
• Information disclosure

Information Disclosure via 'Copy learned MAC Addresses' Function

• Murrelektronik Xelity 4TX M GE
• Murrelektronik Xelity 4TX M GE PN
• Information disclosure

OneNav 1.2.4 contains an authenticated arbitrary file deletion vulnerability via import_link().

• Information disclosure

alexta69 MeTube Cookie File cookies.txt file access

• alexta69 MeTube
• Broken access control
• Information disclosure

SiYuan before v3.8.0 Secret Exfiltration via http_request URL

• siyuan
• Information disclosure

WWBN AVideo Unbound Token Authorization Bypass via Gallery

• WWBN AVideo
• Information disclosure

AVideo feed/index.php Exposure of Channel Owner Email Address

• WWBN AVideo
• Information disclosure

Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path

• Tutor LMS
• Information disclosure

FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure

• FiboSearch
• Information disclosure

Combodo iTop: Access control bypass via OQL joins

• Combodo iTop
• Information disclosure

Combodo iTop: Information disclosure in ajax.render.php

• Combodo iTop
• Information disclosure

CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)

• cenodude CrossWatch
• Information disclosure

information disclosure vulnerability in Esri Portal for ArcGIS

• Esri Portal for ArcGIS
• Information disclosure

information disclosure vulnerability in Esri Portal for ArcGIS

• Esri Portal for ArcGIS
• Information disclosure

Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution

• microsoft UFO
• Information disclosure
• CWE-346

Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows

• git
• Information disclosure
• CWE-610

Combodo iTop: Version disclosure via login page logo

• Combodo iTop
• Information disclosure

Combodo iTop: Insecured access to uploaded images via sniffed url

• Combodo iTop
• Information disclosure
• Authentication bypass

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

• j2commerce.com J2Store extension for Joomla
• Cross-site request forgery (CSRF)
• Information disclosure

Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled

• bluewave-labs Checkmate
• Information disclosure
• Hard-coded credentials

Brushfire unauthenticated information disclosure

• Brushfire Online Experience
• Information disclosure

Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation

• Spring AI
• Information disclosure

Apache CloudStack: Improper access control in Userdata reference APIs

• Apache Software Foundation Apache CloudStack
• Information disclosure
• Broken access control

Apache CloudStack: Unauthenticated OAuth provider client-secret disclosure

• Apache Software Foundation Apache CloudStack
• Information disclosure

Apache CloudStack: Sensitive Information Disclosure via Cleartext Storage in AsyncJob

• Apache Software Foundation Apache CloudStack
• Information disclosure

Apache CloudStack: LDAP provider configuration disclosure

• Apache Software Foundation Apache CloudStack
• Information disclosure

Apache CloudStack: OAuth2 Token Cross-Request Leak

• Apache Software Foundation Apache CloudStack
• Information disclosure

Apache CloudStack: Webhook Deliveries Incorrect Access

• Apache Software Foundation Apache CloudStack
• Information disclosure
• Broken access control

Copy & Delete Posts < 1.5.6 - Authenticated Arbitrary Post Content and Password Disclosure

• Duplicate Post
• Information disclosure

Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint

• Dokan: AI Powered WooCommerce Multivendor Marketplace Solution
• Information disclosure

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• Information disclosure

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• Information disclosure

Vulnerabilities in IBM AIX and PowerVM VIOS

• IBM AIX
• IBM PowerVM VIOS
• Information disclosure

Mailpit: WebSocket origin check bypass via percent-encoded path (regression of CVE-2026-22689)

• Information disclosure
• CWE-177

>=1.29.0, <1.30.6 · fixed in 1.30.6

Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace

• Red Hat Advanced Cluster Management for Kubernetes 2.11
• Red Hat Advanced Cluster Management for Kubernetes 2.13
• Information disclosure

Winter: Local File Inclusion through =include directives in JavaScript asset compilation

• Path traversal
• Information disclosure

<1.2.13 · fixed in 1.2.13

netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages

• Information disclosure

<0.0.23.Final · fixed in 0.0.23.Final

NocoBase: Arbitrary File Write chained with Local file Inclusion leads to Remote code execution

• Path traversal
• Information disclosure

<2.1.5 · fixed in 2.1.5

libgit2: HTTP transport can leak credentials to an offsite redirect target

• libgit2
• Information disclosure
• Hard-coded credentials

next-video: Unauthenticated arbitrary file read via /api/video request handler

• Path traversal
• Information disclosure

<2.8.1 · fixed in 2.8.1

Coder: Login endpoint user enumeration via timing-defense placeholder in password comparison

• Information disclosure
• CWE-204

<2.29.17 || >=2.30.0, <2.32.7 || >=2.33.0, <2.33.8 || >=2.34.0, <2.34.2 · fixed in 2.29.17, 2.32.7, 2.33.8, 2.34.2