Information disclosure.

Exposure of personal information in Apple iOS and iPadOS

• Apple iOS and iPadOS
• Information disclosure

Information disclosure in Apple iOS and iPadOS and others

• Apple iOS and iPadOS
• Apple macOS
• Information disclosure

Information disclosure in Apple macOS

• Apple macOS
• Information disclosure

cosmicstack-labs mercury-agent Shell Permission Manifest permissions.ts PermissionManager.checkShellCommand information disclosure

• cosmicstack-labs mercury-agent
• Information disclosure
• Broken access control

Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure

• Brain Trust Gallery - Private Photo Vault
• Information disclosure

Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

• Apache Software Foundation Apache Storm Nimbus
• Apache Software Foundation Apache Storm Client
• Hard-coded credentials
• Information disclosure

Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

• Apache Software Foundation Apache Storm Nimbus
• Apache Software Foundation Apache Storm UI
• Information disclosure
• Hard-coded credentials

Apache Syncope: JWT Access Token takeover

• Apache Software Foundation Apache Syncope
• Information disclosure

Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user

• Apache Software Foundation Apache Syncope
• Information disclosure

Apache Syncope: AES Secret Key disclosure via log output

• Apache Software Foundation Apache Syncope
• Information disclosure

MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

• MISP
• Information disclosure
• Hard-coded credentials

Joomla Extension - regularlabs.com - Database data disclosure in Advanced Module Manager (Free, Pro) < 12.1.0, Conditional Content (Free, Pro) < 8.0.0, Content Templater (Pro) < 14.2.0, ReReplacer (P…

• regularlabs.com Advanced Module Manager (Free, Pro) extension for Joomla
• regularlabs.com Conditional Content (Free, Pro) extension for Joomla
• Information disclosure

Chengdu Qilu Technology Ludashi ComputerZ_x64.sys sub_11008 information disclosure

• Chengdu Qilu Technology Ludashi
• Information disclosure
• Broken access control

Bookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availability Check

• Bookit — Booking & Appointment Calendar
• Information disclosure

User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You Page

• User Registration & Membership
• Information disclosure

Social Contact Form (FormyChat) < 2.15.8 - Unauthenticated Gravity Forms Entry Disclosure via formychat_get_gf_entry

• Contact Form to Chat Apps | Click to Chat to Order
• Information disclosure

WWBN AVideo Missing Authorization via mediaSession.json.php

• WWBN AVideo
• Information disclosure

WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint

• WWBN AVideo
• Information disclosure

WWBN AVideo Missing Authorization in ImageGallery list.json.php

• WWBN AVideo
• Information disclosure

WWBN AVideo Unauthenticated Information Disclosure via menus.json.php

• WWBN AVideo
• Information disclosure

WWBN AVideo Missing Authentication via menuItems.json.php

• WWBN AVideo
• Information disclosure

WWBN AVideo Missing Authorization via playlistsFromUser.json.php

• WWBN AVideo
• Information disclosure

WWBN AVideo Missing Authorization via adsInfo API Endpoint

• WWBN AVideo
• Information disclosure

Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameter

• wproyal Royal Addons for Elementor – Addons and Templates Kit for Elementor
• Information disclosure

WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure

• WPBot
• Information disclosure

Zonify < 1.0.5 - Unauthenticated Account Login Token Disclosure

• Zonify
• Information disclosure

Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Download

• Yogeta WP Cloud
• Information disclosure

SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema

• SureRank SEO
• Information disclosure

Mousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state

• t-mart mousehole
• Information disclosure
• Authentication bypass

nl.nl-portal:app has GraphiQL UI and GraphQL schema introspection enabled by default

• nl.nl-portal:app
• Information disclosure
• CWE-1188

Kiro IDE Sensitive Workspace Data Exfiltration via Agent-Written Workspace Configuration

• AWS Kiro IDE
• Information disclosure
• CWE-829

WordPress ElasticPress plugin <= 5.3.4 - Sensitive Data Exposure vulnerability

• 10up ElasticPress
• Information disclosure

ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere

• ST Engineering iDirect Evolution iQ‑Series terminals
• ST Engineering iDirect 3315-Series terminals
• Information disclosure

Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get

• Red Hat build of Keycloak 26.6.8
• Red Hat Single Sign-On 7
• Information disclosure

AVideo WebRTC Plugin Information Disclosure via status.json.php

• WWBN AVideo
• Information disclosure

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure

• teddy-bear-customize-addon
• Information disclosure

rclone: http backend forwards custom/auth headers to a different host on redirect

• Information disclosure
• Weak cryptography or TLS

>=1.49.0, <1.75.1 · fixed in 1.75.1

Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication

• Information disclosure

>=0.6.27, <0.11.1 · fixed in 0.11.1

Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`

• Information disclosure
• CWE-524

<=19.2.25 || >=20.0.0, <20.3.28 || >=21.0.0, <21.2.20 || >=22.0.0, <22.1.1 · fixed in 20.3.28, 21.2.20, 22.1.1

Consul-template vulnerable to an information disclosure issue in error handling

• HashiCorp Tooling
• Information disclosure

Storage of Sensitive Information in Cleartext in NI SystemLink

• NI SystemLink
• NI SystemLink Server
• Information disclosure

Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

• Information disclosure
• Broken access control

>=0.7.0, <0.11.1 · fixed in 0.11.1

WordPress ZHBackup – Backup, Restore & Migration plugin <= 2.4.2 - Sensitive Data Exposure vulnerability

• Zain Hassan ZHBackup – Backup, Restore &amp; Migration
• Information disclosure

OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure

• openpanel
• Information disclosure

Renovate before 44.14.4 TLS Private Key Log Sanitisation

• renovate
• mend renovate-ce
• Information disclosure

AVideo PlayerSkins seo.php Missing Authorization Password-Protected VOD

• WWBN AVideo
• Information disclosure

AVideo Incomplete API Sanitization Information Disclosure

• WWBN AVideo
• Information disclosure

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 Authentication Bypass

• WWBN AVideo
• Information disclosure

Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0

• joomlart.com T4 Page Builder extension for Joomla
• Information disclosure

Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property < 4.1.4

• joomshaper.com SP Property extension for Joomla
• Information disclosure

Ultimate Gift Cards for WooCommerce 3.0.3 - 3.2.9 - Unauthenticated Gift Card Code and Customer PII Disclosure via wps_uwgc_report_details

• Ultimate Gift Cards for WooCommerce
• Information disclosure

Prisma Access Agent: Information Disclosure Vulnerability on Linux

• Palo Alto Networks Prisma Access Agent
• Information disclosure

SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`

• Information disclosure
• Broken access control

<0.27.1 · fixed in 0.27.1

Snipe-IT before 8.7.0 Cross-Company Read via requested-assets

• grokability snipe-it
• Information disclosure

CWE-532: Insertion of Sensitive Information into Log File

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• Information disclosure

Sensitive information in log files in Dell Secure Connect Gateway 5.0 - Application and others

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• Information disclosure

CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner

• usmannasir cyberpanel
• Information disclosure

Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock

• siyuan
• Information disclosure

Sensitive information is leaked into NeuVector’s manager container logs

• SUSE neuvector
• Information disclosure

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Externally-Accessible File or Direct…

• Dell Secure Connect Gateway 5.0 - Application
• Dell Secure Connect Gateway 5.0 - Appliance
• Information disclosure