Information disclosure.

JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

• Command injection
• Information disclosure

>=4.0.0, <4.5.11 || >=4.6.0, <4.6.4 · fixed in 4.5.11, 4.6.4

devalue: `stringify`/`uneval` serialize shared memory

• Information disclosure
• CWE-226

>=5.1.0, <5.9.3 · fixed in 5.9.3

HCL BigFix Service Management is affected by multiple security vulnerabilities.

• HCL Software HCL BigFix Service Management
• Information disclosure

HCL BigFix Service Management is affected by multiple security vulnerabilities.

• HCL Software HCL BigFix Service Management
• Information disclosure
• Hard-coded credentials

HCL iControl is affected by an Improper Error Handling vulnerability

• HCL Software iControl
• Information disclosure

WordPress CF7 Apps plugin <= 3.7.2 - Sensitive Data Exposure vulnerability

• WPExperts CF7 Apps
• Information disclosure

WordPress Pie Register plugin <= 3.8.4.13 - Sensitive Data Exposure vulnerability

• Shamim Rajani Pie Register
• Information disclosure

WordPress WP Ultimate CSV Importer plugin <= 9.1 - Sensitive Data Exposure vulnerability

• Smackcoders Inc. WP Ultimate CSV Importer
• Information disclosure

Apache APISIX: data-mask may fail to redact request headers in logger output

• Apache Software Foundation Apache APISIX
• Information disclosure

Ghost 3.23.0 before 6.23.0 API Key Exposure via Admin API

• Ghost
• Information disclosure

Ghost 0.8.0 before 6.23.0 Information Disclosure via Setup Endpoint

• Ghost
• Information disclosure

Ghost 5.42.2 before 6.58.0 Password Hash Disclosure

• Ghost
• Information disclosure

Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API

• Ghost
• Information disclosure

Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log

• Payments for Hubtel
• Information disclosure

WP Popular Posts <= 7.4.2 - Unauthenticated Information Disclosure in 'post_type' and 'context' Parameters

• hcabrera WP Popular Posts
• Information disclosure

GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle

• Command injection
• Information disclosure

>=3.1.59, <3.1.60 · fixed in 3.1.60

Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor

• Kiteworks Secure Data Forms
• Information disclosure
• Authentication bypass

Kiteworks Core Sandbox Escape

• Kiteworks Core
• Information disclosure
• CWE-653

Information disclosure in NVIDIA GeForce and others

• NVIDIA GeForce
• NVIDIA RTX, Quadro, NVS
• Information disclosure

Information disclosure in JetBrains YouTrack

• JetBrains YouTrack
• Information disclosure

WordPress MPG plugin <= 4.2.3 - Sensitive Data Exposure vulnerability

• Themeisle MPG
• Information disclosure

WordPress Notivo plugin <= 1.4.2 - Sensitive Data Exposure vulnerability

• VillaTheme Notivo
• Information disclosure

WordPress BackupEase plugin <= 2.2.2 - Sensitive Data Exposure vulnerability

• PrecisionWP BackupEase
• Information disclosure

WordPress StifLi Backup Tools plugin <= 2.2.7 - Sensitive Data Exposure vulnerability

• Esteban StifLi Backup Tools
• Information disclosure

Alert rules in restricted folders disclosed via the alert rules list API

• Grafana Enterprise
• Grafana OSS
• Information disclosure
• Broken access control

Moodle: user profile information disclosure via grade web service

• Information disclosure

Sensitive information in log files in Pgpool Global Development Group Pgpool-II

• Pgpool Global Development Group Pgpool-II
• Information disclosure

Course Booking System < 7.0.9 - Unauthenticated Attendee PII Disclosure via CSV Export

• Course Booking System
• Information disclosure

YayReviews 1.0.4 - 1.4.0 - Unauthenticated Sensitive Data Disclosure via REST API

• YayReviews
• Information disclosure

Image Optimizer by Elementor < 1.7.7 - Subscriber+ Attachment Metadata and Site Statistics Disclosure via Discarded REST Permission Callbacks

• Image Optimizer
• Information disclosure

Connections Business Directory <= 10.4.67 - Unauthenticated Non-Public Directory Entry Disclosure via cn-api/v1 REST Routes

• Connections Business Directory
• Information disclosure

New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass

• New User Approve
• Information disclosure

Solace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes

• Solace Extra
• Information disclosure

gedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure

• gedelumbung HospitalManagement
• Information disclosure
• Broken access control

PyJWT: PyJWKClient follows redirects when fetching JWKS

• Information disclosure
• Server-side request forgery (SSRF)

<2.14.0 · fixed in 2.14.0

Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B

• WatchGuard Fireware OS
• Information disclosure
• Denial of service

Toptech TMS7 and TopHAT Files or Directories Accessible to External Parties

• Toptech Systems TMS7
• Toptech Systems TopHAT
• Information disclosure

Authenticated Local Sensitive Information Disclosure in HPE Networking Instant On

• Hewlett Packard Enterprise (HPE) Instant ON
• Information disclosure

undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

• Information disclosure
• CWE-524

>=7.0.0, <7.29.1 || >=8.0.0, <8.10.2 · fixed in 7.29.1, 8.10.2

Information disclosure in Eclipse Foundation Eclipse ThreadX

• Eclipse Foundation Eclipse ThreadX
• Information disclosure
• Memory corruption

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)

• Wikimedia Foundation Mediawiki - CentralAuth Extension
• Information disclosure

Private change tags exposed to anonymous users via revision-tags-change events

• Wikimedia Foundation Mediawiki - EventBus Extension
• Information disclosure

Cleartext storage of sensitive information in Devolutions Server

• Devolutions Server
• Information disclosure

Information disclosure in Devolutions Server

• Devolutions Server
• Information disclosure

Sensitive information leak through hidden menu

• EVbee DC-80
• Information disclosure

Sensitive Data Exposure in Parla Auto's DetaWix Mobile Web Portal

• Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal
• Information disclosure

Other issue in the DevTools component

• Mozilla Thunderbird
• Mozilla Firefox
• Information disclosure

Information disclosure in the Networking component

• Mozilla Thunderbird
• Mozilla Firefox
• Information disclosure

Information disclosure in the Networking: JAR component

• Mozilla Firefox
• Mozilla Thunderbird
• Information disclosure

Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs

• Apache Software Foundation Apache Airflow Teradata provider
• Information disclosure

Intelbras TIP 125i Básico sensitive information in source

• Intelbras TIP 125i
• Information disclosure
• CWE-540

SiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages

• siyuan
• Information disclosure

Eleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosure

• Eleveo Quality Management
• Information disclosure
• Broken access control

Eleveo Quality Management QMBODownload information disclosure

• Eleveo Quality Management
• Information disclosure
• Broken access control

PMWeb encryptionhelper.dll information disclosure

• PMWeb
• Information disclosure
• Broken access control