Information disclosure.

WPFunnels < 3.13.0 - Unauthenticated Order and Opt-In PII Disclosure via Web-Accessible Log Files

• WPFunnels
• Information disclosure

Pods < 3.3.9.2 - Author+ Arbitrary File Read via Shortcode Display Callback

• Pods
• Information disclosure

Content Views < 4.5.1.2 - Unauthenticated Non-Public Post Content Disclosure via Views Status Filter

• Content Views
• Information disclosure

An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to retriev…

• Information disclosure

An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 returns detailed system version fields (operatingsystem,…

• Information disclosure

An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any remote authenticated user, including use…

• Information disclosure

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components

• Information disclosure

Files accessible to external parties in WebPros ConfigServer Security & Firewall and others

• WebPros ConfigServer Security & Firewall
• ConfigServer Security & Firewall
• Information disclosure

SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents

• Information disclosure
• Broken access control

<0.0.0-20260724091654-82e9ded423e4 · fixed in 0.0.0-20260724091654-82e9ded423e4

Resource exposure in Google Chrome

• Google Chrome
• Information disclosure

Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

• medplum
• Information disclosure

WordPress KP Agent Ready plugin < 1.2.08 - Sensitive Data Exposure vulnerability

• Kevin Pirnie KP Agent Ready
• Information disclosure

CKAN MCP Server: Information disclosure via verbose error reflection

• Information disclosure
• CWE-210

<0.4.112 · fixed in 0.4.112

SiYuan before v3.8.2 API Token Exposure via Log File

• siyuan
• Information disclosure

n8n before 1.123.73 Credential Exposure via Error Logging

• n8n
• Information disclosure

WWBN AVideo Broken Access Control via feed/index.php program_id

• WWBN AVideo
• Information disclosure

WWBN AVideo Broken Access Control via Channel Page

• WWBN AVideo
• Information disclosure

OpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs

• Authentication bypass
• Information disclosure

<1.0.2 || >=1.1.0, <1.1.2 · fixed in 1.0.2, 1.1.2

Handlebars.java: Arbitrary file read in `SpringTemplateLoader` via URL-fragment suffix bypass

• Path traversal
• Information disclosure

<4.5.3 · fixed in 4.5.3

Hurl: Cookies in Cookies section leak when redirecting to a different host

• Information disclosure

<=8.0.1 · no fixed version yet

Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

• Code injection
• Information disclosure

<2.0.2 · fixed in 2.0.2

Boruta: OAuth credentials exposed in Boruta business logs

• malach-it boruta-server
• Information disclosure

Nexus Repository 3 - Webhook Secret Disclosure via Capability Read API

• Sonatype Nexus Repository 3
• Information disclosure

Information disclosure in Jenkins Project Jenkins Script Security Plugin

• Jenkins Project Jenkins Script Security Plugin
• Information disclosure

DXPR Builder: The AI Visual Page Builder for Drupal - Moderately critical - Information Disclosure - SA-CONTRIB-2026-112

• DXPR Builder: The Best Editing (AI) Experience for Drupal
• Information disclosure

WordPress WooCommerce Product Attachment plugin <= 2.3.4 - Sensitive Data Exposure vulnerability

• Dotstore WooCommerce Product Attachment
• Information disclosure

MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route

• MasterStudy LMS WordPress Plugin
• Information disclosure

MasterStudy LMS < 3.7.46 - Unauthenticated Unpublished Course Title Disclosure via course-list REST Route

• MasterStudy LMS WordPress Plugin
• Information disclosure

MasterStudy LMS < 3.7.46 - Unauthenticated Student Enrollment Disclosure via student-courses REST Route

• MasterStudy LMS WordPress Plugin
• Information disclosure

FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response

• FormLayer
• Information disclosure

Rank Math SEO < 1.0.277.1 - Unauthenticated Password-Protected Post Content Disclosure via Post Metadata and llms.txt

• Rank Math SEO
• Information disclosure

Ultimate Member < 2.13.0 - Unauthenticated Unapproved Comment Disclosure via Profile Activity

• Ultimate Member
• Information disclosure

Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API

• Gutentor
• Information disclosure

Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content

• Solace Extra
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

WWBN AVideo through 30.0 Information Disclosure via MobileManager

• WWBN AVideo
• Information disclosure

Authenticated Sensitive Information Disclosure Vulnerabilities in AOS-CX

• Hewlett Packard Enterprise (HPE) AOS-CX
• Information disclosure

Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Information disclosure

Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Information disclosure

Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Information disclosure

Unauthenticated Limited Information Disclosure leads to Data Exposure in HPE Networking Fabric Composer

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Information disclosure

Authenticated Access Control Vulnerabilities allow Information Disclosure in HPE Networking Fabric Composer API

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Information disclosure

Local Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Information disclosure

Authenticated Arbitrary File Write leads to Remote Code Execution in HPE Networking Fabric Composer

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Information disclosure

Unauthenticated Limited Information Disclosure allows Data Exposure in the API of HPE Networking Fabric Composer

• Hewlett Packard Enterprise (HPE) Fabric Composer
• Information disclosure

Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests

• Information disclosure

<3.17.2 · fixed in 3.17.2

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

• Information disclosure
• Weak cryptography or TLS

>=10.7.0, <10.34.5 || >=11.0.0, <11.11.0 · fixed in 10.34.5, 11.11.0

Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path

• AWS sagemaker-python-sdk
• Information disclosure

Kirby: System path exposure from error messages in the REST API

• Information disclosure

<4.9.5 || >=5.0.0, <5.5.2 · fixed in 4.9.5, 5.5.2

Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts

• Red Hat Certificate System 9
• Red Hat Enterprise Linux 10
• Information disclosure
• Broken access control

Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15

• Mozilla Firefox
• Mozilla Thunderbird
• Information disclosure

Internally found bugs fixed in Thunderbird 155

• Mozilla Firefox
• Mozilla Thunderbird
• Information disclosure

Other issue in the DOM: Navigation component

• Mozilla Firefox
• Mozilla Thunderbird
• Information disclosure

Other issue in Firefox Focus for Android

• Mozilla Firefox
• Information disclosure

Other issue in the Profile Backup component

• Mozilla Firefox
• Mozilla Thunderbird
• Information disclosure

Information disclosure in the Networking: HTTP component

• Mozilla Firefox
• Mozilla Thunderbird
• Information disclosure

Information disclosure in the Graphics: WebGPU component

• Mozilla Firefox
• Mozilla Thunderbird
• Information disclosure

Information disclosure in the WebExtensions component in Firefox for Android

• Mozilla Firefox
• Information disclosure

Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure

• Red Hat Certificate System 9
• Red Hat Enterprise Linux 10
• Information disclosure