Advisories · Weakness
Information disclosure.
Sensitive data exposed to people who shouldn’t see it. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.8 Medium
Duplicate Advisory: vm2: util.getCallSites() bypasses GHSA-v27g host-frame redaction, leaks host call stack
- Information disclosure
<=3.11.7 · no fixed version yet
GHSA-2vh9-cv26-p97m - CVSS 5.3 Medium
Vendure: Shop API list queries can return non-public entities when filterOperator is OR
- Information disclosure
>=1.0.0, <3.6.5 · fixed in 3.6.5
GHSA-xf65-r35x-wmmv · CVE-2026-63461 - CVSS 6.8 Medium
RMCP: Custom HTTP headers leak to cross-origin redirect targets
- Information disclosure
<2.1.0 · fixed in 2.1.0
GHSA-9g45-5xwm-f3wc · CVE-2026-64684 - CVSS 7.3 High
Information disclosure in Dell OpenManage Server Administrator Managed Node (Patch) for Windows and others
- Dell OpenManage Server Administrator Managed Node (Patch) for Windows
- Dell OpenManage Server Administrator Managed Node for RHEL 8.10
- Information disclosure
- CVSS 1.8 Low
Actor record with password digest stored in AshAuthentication audit log entries
- Information disclosure
>=4.12.0, <4.15.0 || >=5.0.0-rc.0, <5.0.0-rc.2 · fixed in 4.15.0, 5.0.0-rc.2
GHSA-59wx-q3r8-ghv4 · CVE-2026-82723 - CVSS 8.7 High
admin3 through 3.0.0 Session Token Disclosure via Audit Log
- cjbi admin3
- Information disclosure
- CVSS 8.7 High
Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r
- grav
- Information disclosure
- CVSS 8.7 High
Grav through 2.0.21 Unauthenticated Information Disclosure via Clockwork
- grav
- Information disclosure
- CVSS 2.7 Low
WebSocket Exposure Vulnerability in NitroSense and PredatorSense Software
- Acer System Monitoring
- Information disclosure
- CVSS 5.7 Medium
Service token exposure and potential privilege escalation in SUSE Observability
- SUSE Observability
- Information disclosure
- CVSS 2.7 Low
Comments Import & Export 2.1.11 - 2.5.3 - Author+ Comment PII Disclosure via Export
- Comments Import & Export
- Information disclosure
- CVSS 3.7 Low
LearnPress 4.4.3 - 4.4.6 - Unauthenticated Quiz Answer Disclosure via check-answer REST Endpoint
- LearnPress
- Information disclosure
- CVSS 6.5 Medium
djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client
- Information disclosure
<1.0.7 · fixed in 1.0.7
GHSA-pvg3-6q9j-mj3x · CVE-2026-61588 - CVSS 8.7 High
Craft CMS before 5.11.0 Unauthenticated PII Disclosure via GraphQL
- cms
- Information disclosure
- CVSS 7.1 High
browserless 1.44.0 through 2.56.7 File Protocol Restriction Bypass
- browserless
- Information disclosure
- CVSS 7.1 High
Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter
- harbor
- Information disclosure
- CVSS 8.8 High
Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Information Exposure & Insecure Handling
- Cisco Nexus Dashboard
- Information disclosure
- CVSS 6.5 Medium
Tanium addressed an information disclosure vulnerability in Discover.
- Tanium Discover
- Information disclosure
- CVSS 6.0 Medium
Under certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users.
- Arista Networks EOS
- Information disclosure
- CVSS 2.1 Low
On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privi…
- Arista Networks EOS
- Information disclosure
- CVSS 6.9 Medium
Rallly before 4.15.0 Information Disclosure via polls.get
- lukevella rallly
- Information disclosure
- CVSS 7.4 High
djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG
- Authentication bypass
- Information disclosure
<1.0.7 · fixed in 1.0.7
GHSA-8g2f-g3gq-5rjv · CVE-2026-61590 - CVSS 5.3 Medium
a2ui-project a2ui Model Processor model-processor.ts information disclosure
- a2ui
- Information disclosure
- Broken access control
- CVSS 6.9 Medium
Cleartext Storage of Sensitive Information Vulnerability
- Fermax Electronica S.A.U. DuoxMe
- Information disclosure
- CVSS 6.5 Medium
Information Disclosure via Schema Path Manipulation
- Pepperl+Fuchs ICE2-8IOL1-G65L-V1D
- Pepperl+Fuchs ICE2-8IOL-G65L-V1D
- Information disclosure
- CVSS 5.3 Medium
Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes
- Rox Appointment Booking
- Information disclosure
- CVSS 5.3 Medium
Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route
- Rox Appointment Booking
- Information disclosure
- CVSS 5.3 Medium
Subscriptions for WooCommerce < 2.0.3 - Unauthenticated Subscription Data Disclosure via REST API Secret Key Bypass
- Subscriptions for WooCommerce
- Information disclosure
- CVSS 5.3 Medium
LearnPress < 4.4.7 - Unauthenticated Unpublished Course Disclosure via REST API
- LearnPress
- Information disclosure
- CVSS 3.7 Low
LearnPress < 4.4.7 - Unauthenticated Order Data Disclosure via lp_download_order
- LearnPress
- Information disclosure
- CVSS 5.3 Medium
LearnPress < 4.4.7 - Unauthenticated Student Enrollment Disclosure via load_content_via_ajax
- LearnPress
- Information disclosure
- CVSS 5.3 Medium
LearnPress < 4.4.7 - Unauthenticated Question Bank Disclosure via load_content_via_ajax
- LearnPress
- Information disclosure
- CVSS 4.3 Medium
Tutor LMS 4.0.0 - < 4.0.8 - Subscriber+ Cross-Course Lesson Comment Disclosure
- Tutor LMS
- Information disclosure
- CVSS 4.3 Medium
FluentBoards < 2.0.15 - Subscriber+ Private Board Membership Disclosure via IDOR
- FluentBoards
- Information disclosure
- CVSS 5.3 Medium
Schema & Structured Data for WP & AMP < 1.66 - Unauthenticated Password-Protected Post Content Disclosure via JSON-LD Schema Output
- Schema & Structured Data for WP & AMP
- Information disclosure
- CVSS 5.3 Medium
Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated Order and Customer Data Disclosure via 'btn_print' Parameter
- Ni WooCommerce Sales Report
- Information disclosure
- CVSS 4.6 Medium
MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage.
- Information disclosure
- CVSS 7.6 High
DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within non-volatile memory.
- Information disclosure
- CWE-316
- CVSS 7.1 High
Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints
- Netcore NR255-V
- Information disclosure
- CVSS 5.3 Medium
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 5.3 Medium
Observable discrepancy in Google Chrome
- Google Chrome
- Information disclosure
- CVSS 7.5 High
`tts-be` application has a Broken Access Control vulnerability
- NIAEFEUP tts-be
- Information disclosure
- Authentication bypass
- CVSS 6.5 Medium
Sensitive information in log files in Devolutions PowerShell Universal
- Devolutions PowerShell Universal
- Information disclosure
- CVSS 7.1 High
Information disclosure in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Information disclosure
- CVSS 7.5 High
Information disclosure in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Information disclosure
- CVSS 7.1 High
Information disclosure in Oracle Corporation Oracle Hyperion Financial Management
- Oracle Corporation Oracle Hyperion Financial Management
- Information disclosure
- CVSS 7.7 High
Information disclosure in Oracle Corporation Oracle Purchasing
- Oracle Corporation Oracle Purchasing
- Information disclosure
- CVSS 6.5 Medium
Information disclosure in Oracle Corporation Oracle Assets
- Oracle Corporation Oracle Assets
- Information disclosure
- CVSS 7.7 High
Information disclosure in Oracle Corporation Oracle Engineering
- Oracle Corporation Oracle Engineering
- Information disclosure
- CVSS 8.5 High
Information disclosure in Oracle Corporation Oracle Complex Maintenance, Repair and Overhaul
- Oracle Corporation Oracle Complex Maintenance, Repair and Overhaul
- Information disclosure
- CVSS 7.5 High
Information disclosure in Oracle Corporation Oracle JDeveloper
- Oracle Corporation Oracle JDeveloper
- Information disclosure
- CVSS 5.4 Medium
Information disclosure in Oracle Corporation Oracle Communications Cloud Native Core Security Edge…
- Oracle Corporation Oracle Communications Cloud Native Core Security Edge Protection Proxy
- Information disclosure
- CVSS 7.1 High
Information disclosure in Oracle Corporation Oracle Communications Cloud Native Core Security Edge…
- Oracle Corporation Oracle Communications Cloud Native Core Security Edge Protection Proxy
- Information disclosure
- CVSS 2.5 Low
Information disclosure in Oracle Corporation Oracle Coherence
- Oracle Corporation Oracle Coherence
- Information disclosure
- CVSS 6.3 Medium
Information disclosure in Oracle Corporation Oracle Coherence
- Oracle Corporation Oracle Coherence
- Information disclosure
- CVSS 7.1 High
Information disclosure in Oracle Corporation Oracle XML Gateway
- Oracle Corporation Oracle XML Gateway
- Information disclosure
- CVSS 7.5 High
Information disclosure in Oracle Corporation Siebel CRM Integration
- Oracle Corporation Siebel CRM Integration
- Information disclosure
- CVSS 8.5 High
Information disclosure in Oracle Corporation Oracle BI Publisher
- Oracle Corporation Oracle BI Publisher
- Information disclosure
- CVSS 7.1 High
Information disclosure in Oracle Corporation Oracle XML Gateway
- Oracle Corporation Oracle XML Gateway
- Information disclosure
- CVSS 7.7 High
Information disclosure in Oracle Corporation Oracle Business Intelligence Enterprise Edition
- Oracle Corporation Oracle Business Intelligence Enterprise Edition
- Information disclosure