Information disclosure.

WordPress Five Star Restaurant Reservations plugin <= 2.7.24 - Sensitive Data Exposure vulnerability

• Etoile Web Design Incorporated Five Star Restaurant Reservations
• Information disclosure

Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

• plane
• Information disclosure
• Broken access control

SiYuan: TLS Private Keys Readable via getFile (Incomplete Blocklist)

• Information disclosure

<0.0.0-20260819144130-256d73aa7f94 · fixed in 0.0.0-20260819144130-256d73aa7f94

SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*

• Information disclosure
• Broken access control

<0.0.0-20260816034002-035bf9a8c311 · fixed in 0.0.0-20260816034002-035bf9a8c311

Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member

• plane
• Information disclosure
• Broken access control

WordPress WP Event Solution plugin <= 4.1.25 - Sensitive Data Exposure vulnerability

• Arraytics WP Event Solution
• Information disclosure

Environment/ini-file leaks

• The Document Foundation LibreOffice
• Information disclosure

LFI and GET SSRF via GStreamer and HLS playlists

• The Document Foundation LibreOffice
• Information disclosure
• Server-side request forgery (SSRF)

LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db href

• The Document Foundation LibreOffice
• Information disclosure

LFI and GET SSRF via calcext:data-mappings and csv provider

• The Document Foundation LibreOffice
• Information disclosure
• Server-side request forgery (SSRF)

WordPress Video Conferencing with Zoom plugin <= 4.6.10 - Sensitive Data Exposure vulnerability

• Deepen Bajracharya Video Conferencing with Zoom
• Information disclosure

WordPress Events Manager plugin <= 7.4.5 - Sensitive Data Exposure vulnerability

• Pixelite Events Manager
• Information disclosure

WordPress Memberful - Membership Plugin plugin <= 1.81.2 - Sensitive Data Exposure vulnerability

• Memberful - Membership Plugin
• Information disclosure

Files accessible to external parties in GROWI

• GROWI
• Information disclosure

Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens

• Red Hat Build of Keycloak
• Red Hat Single Sign-On 7
• Information disclosure

WordPress Mindio Magic MCP plugin <= 0.5.6 - Sensitive Data Exposure vulnerability

• farvisun Mindio Magic MCP
• Information disclosure

ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode

• zitadel
• Information disclosure

SiYuan before 3.8.5 Information Disclosure via /api/block/getDocInfo and getDocsInfo

• siyuan
• Information disclosure

WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability

• StylemixThemes Cost Calculator Builder
• Information disclosure

Weaviate Verba generate_stream Endpoint util.py get_environment information disclosure

• Weaviate Verba
• Information disclosure
• Broken access control

Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Author+ Sensitive Data Disclosure via Schema Field Default Callback

• Five Star Business Profile and Schema
• Information disclosure

Omega Solution CoinEx Crypto Support Ticket API customer information disclosure

• Omega Solution CoinEx Crypto
• Information disclosure
• Broken access control

OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint

• OpenIdentityPlatform OpenAM
• Information disclosure

Native AES packet cipher returns the raw AES key on an alias

• Legion of the Bouncy Castle Inc. BC-LTS-JAVA
• Information disclosure

Pie Register < 3.8.4.14 - Unauthenticated User Email Disclosure via Invitation Code

• Pie Register
• Information disclosure

MetForm 2.2.1 - 4.3.0 - Unauthenticated Debug File Disclosure via HubSpot Forms Integration

• MetForm
• Information disclosure

MetForm < 4.3.1 - Unauthenticated Form Entry Data Disclosure via REST API

• MetForm
• Information disclosure

WP Ultimate CSV Importer < 9.2 - Unauthenticated Imported Data Disclosure via Predictable Log Path

• WP Ultimate CSV Importer
• Information disclosure

WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Separation) in HMAC Signa…

• WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons
• Information disclosure

Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API

• rajnandan1 kener
• Information disclosure

Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive

• backdrop
• Information disclosure

Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

• Information disclosure

<4.5.9 · fixed in 4.5.9

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

• Information disclosure
• Authentication bypass

>=0.1.0, <0.1.7 · fixed in 0.1.7

Vibe-Trading file-read tools expose arbitrary server-readable files

• Path traversal
• Information disclosure

>=0.1.0, <0.1.7 · fixed in 0.1.7

Trigger.dev: V1 coordinator default-secret unauth Socket.IO

• Information disclosure
• Hard-coded credentials

<4.5.4 · fixed in 4.5.4

Armatura LLC Armatura One Insertion of Sensitive Information into Log File

• Armatura LLC Armatura One
• Armatura LLC Armatura One (USA)
• Information disclosure

Armatura LLC Armatura One Insertion of Sensitive Information into Log File

• Armatura LLC Armatura One
• Armatura LLC Armatura One (USA)
• Information disclosure

Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm

• Canonical postgresql-operator
• Information disclosure

RPC secret disclosure via vendor data endpoint in Canonical MAAS

• Canonical MAAS
• Information disclosure

Server-side request forgery in the OAuth2 discovery handling in Loom for AWS

• AWS loom
• Information disclosure
• Server-side request forgery (SSRF)

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

WordPress Smart One Click Setup – Complete Demo Import &amp; Export plugin <= 1.4.3 - Sensitive Data Exposure vulnerability

• Chiranjit Hazarika Smart One Click Setup – Complete Demo Import &amp; Export
• Information disclosure

User Enumeration in Softtr's E-Commerce Pack

• Softtr Informatics Trading Limited Company E-Commerce Pack
• Information disclosure

YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action

• yeswiki
• Information disclosure

SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo

• siyuan
• Information disclosure

Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget

• themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
• Information disclosure

Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap

• Legion of the Bouncy Castle Inc. bc-csharp
• Information disclosure

IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)

• Legion of the Bouncy Castle Inc. bc-csharp
• Information disclosure

Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page

• Giveaways and Contests by RafflePress
• Information disclosure

Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum

• Request a Quote
• Information disclosure

GV-Eye Relay Payment API Key Vulnerability

• GeoVision Inc. GV-Eye
• Information disclosure
• Hard-coded credentials

GV-Eye Hardcoded API Key Vulnerability

• GeoVision Inc. GV-Eye
• Information disclosure
• Hard-coded credentials

Information disclosure in Johnson Controls Easy IO Neo

• Johnson Controls Easy IO Neo
• Information disclosure

Rubygem-katello: improper authorization logic allows resource enumeration

• Red Hat Satellite 6.16 for RHEL 8
• Red Hat Satellite 6.16 for RHEL 9
• Information disclosure

HCL BigFix Service Management is affected by multiple security vulnerabilities.

• HCL Software HCL BigFix Service Management
• Information disclosure

HCL BigFix Service Management is affected by multiple security vulnerabilities.

• HCL Software HCL BigFix Service Management
• Information disclosure

Apache HTTP Server: mod_dav_fs property database read access

• Apache Software Foundation Apache HTTP Server
• Information disclosure

Apache HTTP Server: mod_session: Session cookie not removed during internal redirect

• Apache Software Foundation Apache HTTP Server
• Information disclosure

Information disclosure in Eclipse Foundation Eclipse BaSyx AAS Web UI

• Eclipse Foundation Eclipse BaSyx AAS Web UI
• Information disclosure

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

• Information disclosure

>=3.11.3, <3.11.7 · fixed in 3.11.7