Information disclosure.

Talos Linux: Support bundle does not redact registry credentials

• Information disclosure

<1.14.0-alpha.0.0.20260513110206-76080416beee · fixed in 1.14.0-alpha.0.0.20260513110206-76080416beee

WordPress Infinite Uploads plugin <= 3.4.1 - Sensitive Data Exposure vulnerability

• ClikIT Infinite Uploads
• Information disclosure

GitHub CLI partially discloses authentication tokens in `gh auth status` output

• Information disclosure

<2.97.0 · fixed in 2.97.0

WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

• WPManageNinja FluentCart
• Information disclosure

SessionAuthentication Serializes Plaintext Password to Session Store

• Information disclosure

Published by the maintainers · not yet reviewed by GitHub

>=9.4.0, <=9.4.64 || >=10.0.0, <=10.0.32 || >=11.0.0, <=11.0.32 || >=12.0.0, <=12.0.38 || >=12.1.0, <=12.1.12 · fixed in 9.4.65, 10.0.33, 11.0.33, 12.0.39, 12.1.13

Jetty HttpClient leaks scoped credentials across path boundaries after a dot-segment redirect

• Information disclosure

Published by the maintainers · not yet reviewed by GitHub

>=12.1.0, <=12.1.12 || >=12.0.0, <=12.0.38 || >=11.0.0, <=11.0.32 || >=10.0.0, <=10.0.32 || >=9.4.0, <=9.4.64 · fixed in 9.4.65, 10.0.33, 11.0.33, 12.0.39, 12.1.13

Jetty HttpClient accepts proxy authentication challenges from an HTTPS origin and discloses proxy credentials inside the tunnel

• Information disclosure

Published by the maintainers · not yet reviewed by GitHub

>=12.1.0, <=12.1.12 || >=12.0.0, <=12.0.38 || >=11.0.0, <=11.0.32 || >=10.0.0, <=10.0.32 || >=9.4.0, <=9.4.64 · fixed in 9.4.65, 10.0.33, 11.0.33, 12.0.39, 12.1.13

Information disclosure in Ministry of Land, Infrastructure… and others

• Ministry of Land, Infrastructure, Transport and Tourism Vehicle Inspection Certificate Viewer (for Android)
• Information disclosure

Cleartext storage of sensitive information in GEO CORPORATION "ゲオアプリ" for Android and others

• GEO CORPORATION "ゲオアプリ" for Android
• GEO CORPORATION "ゲオアプリ" for iOS
• Information disclosure

Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.

• Path traversal
• Information disclosure

itsmeravitejak Online-Examination-System dbtables.sql information disclosure

• itsmeravitejak Online-Examination-System
• Information disclosure
• Broken access control

FileRise: Unauthenticated disclosure of internal folder path, client email, and upload policy for FileRise Pro client portals via /api/pro/portals/get.php

• error311 FileRise
• Information disclosure
• Authentication bypass

FileRise: Missing Authentication Guard on File Snippet Preview Endpoint

• error311 FileRise
• Information disclosure
• Authentication bypass

WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php

• LabRedesCefetRJ WeGIA
• Information disclosure
• Authentication bypass

Insecure storage of sensitive information in Dell OS Recovery Tool

• Dell OS Recovery Tool
• Information disclosure

Apprise forwards configured auth headers across cross-origin HTTP redirects

• Information disclosure
• Open redirect

<1.11.0 · fixed in 1.11.0

Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py

• AWS SageMaker Python SDK
• Information disclosure

dbt: Unauthenticated Arbitrary SQL Execution in `dbt docs serve`

• dbt-labs dbt-core
• Path traversal
• Information disclosure

Evolution-data-server: local file disclosure via attach file:// uris

• GNOME evolution-data-server
• Red Hat Enterprise Linux 10
• Information disclosure

FOG adInfo endpoint is reported to disclose the Active Directory join password

• fogproject
• Information disclosure

Discourse: Media uploads remain publicly accessible after category permissions are restricted

• discourse
• Information disclosure
• Broken access control

VeraCrypt: Missing authorization on veracrypt.sys IOCTLs exposes disk topology, symlink targets, and DeviceObject reference count to any client of \\.\VeraCrypt

• VeraCrypt
• Information disclosure

Sensitive information in log files in Dell Terraform Provider for OME

• Dell Terraform Provider for OME
• Information disclosure

Sensitive information in error messages in Dell Terraform Provider for OME

• Dell Terraform Provider for OME
• Information disclosure

MOVEit Transfer Local Disclosure of Session Information Vulnerability

• Progress MOVEit Transfer
• Information disclosure

Sensitive information in log files in Dell Terraform Provider for Redfish

• Dell Terraform Provider for Redfish
• Information disclosure

Gitea hidden-owner repository listing disclosure

• Gitea
• Information disclosure

Gitea restricted-user organization metadata disclosure

• Gitea
• Information disclosure
• Broken access control

Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Information disclosure

Improper Access Control Allows Unauthorized Access to Protected Internal Web Resources in TSplus Remote Access

• TSplus Remote Access
• Information disclosure

Clevis: clevis: pkcs#11 token pin written to world-readable file

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Information disclosure

Unauthorised disclosure of information on Copart’s online billing service

• Copart’s online billing service
• Information disclosure

Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion

• Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
• Information disclosure

WisdomGarden｜Tronclass - Sensitive Data Exposure

• WisdomGarden Tronclass
• Information disclosure

AWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page

• AWP Classifieds
• Information disclosure

Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints

• Tainacan
• Information disclosure

GamiPress 7.9.5 - 8.0.5 - Unauthenticated Private Activity Log Disclosure

• GamiPress
• Information disclosure

WP Data Access < 5.5.84 - Unauthenticated Sensitive Data Disclosure via Table Export

• WP Data Access
• Information disclosure

CodeAtoz B2B Suite for WooCommerce < 1.6.1 - Unauthenticated Guest Quote Disclosure

• CodeAtoZ B2B Suite for WooCommerce
• Information disclosure

Avada (Fusion) Builder <= 3.16.1 - Unauthenticated Sensitive Information Exposure in 'args[link_target]' Parameter via {user_meta} Dynamic Data Token

• themefusion Avada (Fusion) Builder
• Information disclosure

Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator

• Hitachi Ops Center Administrator
• Information disclosure

Observable discrepancy in Google Chrome

• Google Chrome
• Information disclosure

Information disclosure in Google Chrome

• Google Chrome
• Information disclosure

Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability

• Information disclosure

>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2 · fixed in 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2

IBM WebSphere Application Server Liberty Information Disclosure

• IBM WebSphere Application Server - Liberty
• Information disclosure

Improper Request Handling for Active Directory Logins in auth0-lock

• auth0-lock
• Information disclosure
• CWE-598

Active Directory Federation Services (AD FS) Information Disclosure Vulnerability

• Microsoft .NET Framework 3.5
• Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
• Information disclosure

Windows Client Side Caching driver (csc.sys) Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Information disclosure

Windows Storage Information Disclosure Vulnerability

• Microsoft Windows 11 Version 24H2
• Microsoft Windows 11 Version 25H2
• Information disclosure

Windows ALPC Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1809
• Microsoft Windows 10 Version 21H2
• Information disclosure

Microsoft Trace Data Helper Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Information disclosure

Microsoft Trace Data Helper Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Information disclosure

Windows Kernel Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Information disclosure
• Memory corruption

Windows Hello Information Disclosure Vulnerability

• Microsoft Windows 10 Version 21H2
• Microsoft Windows 10 Version 22H2
• Information disclosure

Windows Shell Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Information disclosure

Windows Win32 Kernel Subsystem Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Information disclosure

Windows Common Log File System Driver Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Information disclosure
• CWE-126

Windows NTFS Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Information disclosure

Windows Win32 Kernel Subsystem Information Disclosure Vulnerability

• Microsoft Windows 10 Version 1607
• Microsoft Windows 10 Version 1809
• Information disclosure

Windows MIDI Service Module Information Disclosure Vulnerability

• Microsoft Windows 11 Version 24H2
• Microsoft Windows 11 Version 25H2
• Information disclosure