Information disclosure.

Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions

• Apache Software Foundation Apache Camel
• Information disclosure

NocoDB Sign-in Endpoint AuthService.validateUser information disclosure

• NocoDB
• Information disclosure
• Broken access control

libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c.

• Information disclosure

Rclone 1.64.0 before 1.75.2 serve webdav Authentication Bypass via OPTIONS Requests

• rclone
• Information disclosure

rclone v1.56.0 before v1.75.2 WebDAV Credential Header Leak on Redirect

• rclone
• Information disclosure

Parse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions

• parse-community parse-server
• Information disclosure

GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route

• GiveWP
• Information disclosure

WordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability

• Hai Zheng / Lite Speed Cache LiteSpeed Cache
• Information disclosure

GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action

• GeoDirectory
• Information disclosure

GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint

• GeoDirectory
• Information disclosure

SiYuan: Missing consistency check between packageName and repoURL/repoHash in bazaar package install allows overwriting an existing, trusted plugin

• Information disclosure
• CWE-345

<0.0.0-20260808010544-26ccb40d390e · fixed in 0.0.0-20260808010544-26ccb40d390e

SiYuan: authFilePublishAccess distinguishes hidden and forbidden documents from public and nonexistent ones, and issues a publish-auth cookie for documents it reports as forbidden

• Information disclosure

<0.0.0-20260731093152-c7522b8db586 · fixed in 0.0.0-20260731093152-c7522b8db586

obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields

• Information disclosure
• Broken access control

<1.3.1 · fixed in 1.3.1

obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default

• Information disclosure
• Broken access control

<1.3.1 · fixed in 1.3.1

Unauthenticated SSRF and local file inclusion via DownloadTaskEndpoint WebSocket in Goobi viewer

• intranda goobi-viewer-core
• Authentication bypass
• Information disclosure

baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure

• baserproject basercms
• Path traversal
• Information disclosure

Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin

• stape-io gtm-server-side-wordpress-plugin
• Information disclosure

odhcpd DHCPv6 Short IA_NA/IA_PD Body Stack Disclosure

• openwrt odhcpd
• Memory corruption
• Information disclosure

Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments

• Information disclosure

>=1.6.3, <1.7.0 · fixed in 1.7.0

KNIME Analytics Platform logs credentials of configured proxy when used as an executor

• KNIME Analytics Platform
• Information disclosure

Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API

• Otter Blocks
• Information disclosure

Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API

• Otter Blocks
• Information disclosure

Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Information disclosure

OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters

• openbao
• Information disclosure

Unauthenticated Adjacent Sensitive Information Disclosure and Denial-of-Service in AOS-8 via the PAPI Protocol

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Information disclosure

Unauthenticated Adjacent Sensitive Information Disclosure in AOS-10 Wi-Fi Frame Processing

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Information disclosure

Unauthenticated Sensitive Information Disclosure in the Command Line Interface of AOS-10

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Information disclosure

Unauthenticated Sensitive Information Disclosure leads to Remote Code Execution in AOS-10

• Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
• Information disclosure

draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate)

• jgraph drawio-desktop
• Path traversal
• Information disclosure

Workflow names may be leaked to unauthenticated users in KNIME Business Hub

• KNIME Business Hub
• Information disclosure

Information disclosure in Devolutions Server

• Devolutions Server
• Information disclosure

crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens

• crawlseo
• Information disclosure

Goose: goose: shell history and environment leak via terminal integration

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Information disclosure

webpack-dev-server vulnerable to information disclosure via Host validation bypass in the open-editor endpoint

• webpack-dev-server
• Information disclosure
• CWE-1289

WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability

• WP Desk ShopMagic
• Information disclosure

Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File

• WatchGuard Agent
• Information disclosure
• Broken access control

NewType Infortech｜NT OneAPP - Exposure of Sensitive Information

• NewType Infortech NT OneAPP
• Information disclosure

Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri

• grav
• Information disclosure

Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128

• Drupal Mailer Plus Log
• Information disclosure

SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149

• Drupal SAML SSO - Service Provider
• Information disclosure

massCodeIO massCode Local HTTP Service index.ts information disclosure

• massCode
• Information disclosure
• Broken access control

Insertion of Sensitive Information Into Sent Data in GitLab

• GitLab
• Information disclosure

Files or Directories Accessible to External Parties in Splunk SOAR

• Splunk SOAR
• Information disclosure

Information Disclosure through REST API Authentication in Splunk SOAR

• Splunk SOAR
• Information disclosure

Sensitive Information Disclosure through REST API Query Filters in Splunk SOAR

• Splunk SOAR
• Information disclosure

Information Disclosure through REST API Query Filters in Splunk SOAR

• Splunk SOAR
• Information disclosure

Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

• Information disclosure

>=1.0.0-rc.0, <1.3.0 · fixed in 1.3.0

ApostropheCMS: Exposure of Sensitive Information via predictable export filenames

• Information disclosure

<3.7.1 · fixed in 3.7.1

ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user

• Information disclosure

<4.34.0 · fixed in 4.34.0

ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API

• Information disclosure

<4.34.0 · fixed in 4.34.0

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

• Path traversal
• Information disclosure

>=8.2.0, <8.2.4 || >=8.3.0, <8.3.3 · fixed in 8.2.4, 8.3.3

Slack Morphism verifier errors disclose valid HMACs in the logs

• Information disclosure

>=1.0.0, <2.28.0 · fixed in 2.28.0

Cisco Expressway Series Information Disclosure Vulnerability

• Cisco TelePresence Video Communication Server (VCS) Expressway
• Information disclosure

Insertion of Sensitive Information into Log File in hMailServer

• Progressive Robot Ltd hMailServer
• Information disclosure

Trudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads

• polonel trudesk
• Information disclosure

Click n Chat 1.0.4 - 1.1.2 - Unauthenticated Lead Data Disclosure via click_n_chat_update_lead_list_export_action

• Click n Chat (Chat Widget Integration)
• Information disclosure

WholesaleX < 3.0.9 - Unauthenticated Imported User CSV Disclosure

• WholesaleX
• Information disclosure

SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter

• SureCart
• Information disclosure

Booking Package < 1.7.31 - Unauthenticated Calendar Account Information Disclosure

• Booking Package
• Information disclosure

Snipe-IT before 8.7.0 SSRF Port Scanning via Webhook Testing Endpoint

• grokability snipe-it
• Information disclosure