CWE-200: Information Exposure vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor.

OpenList versions prior to 4.2.4 contain a vulnerability in the search API where a non-separator-aware prefix check allows unauthorized users to access metadata or file-existence information of sibling paths. This occurs because the strings.HasPrefix function is used improperly for path containment authorization, leading to exposure of sensitive information. The issue is fixed in version 4.2.4.

### Impact With a default configuration, an undefined `readPaths`/`writePaths` meant allow-all, the `strictReadDefault` flag was inert, and the `.obsidian`/`.git`/`.trash` control directories were denied only during enumeration — not on the direct request path. A caller could read `.obsidian/plugins/*/data.json`, exfiltrating **plugin API keys and Obsidian Sync passwords** (live-reproduced), as well as any other in-vault file by path. ### Patches Fixed in **1.3.1**. Upgrade to `>= 1.3.1`. The default now denies `.obsidian`/`.git`/`.trash` on read/write/delete and honors `strictReadDefault` on the request path. ### Workarounds Set an explicit `readPaths`/`writePaths` whitelist that excludes the control directories.

Progress MarkLogic Server versions 11.0.0 through before 11.3.7 and 12.0.0 through before 12.1.0 have an exposure of sensitive information vulnerability. A remote authenticated attacker with limited management permissions could access security-sensitive information that should be restricted. This exposure could lead to unauthorized access to protected resources. The vulnerability has a high severity with a CVSS score of 7.7.

A vulnerability in ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 allows attackers to disclose uninitialized memory contents via a crafted TGA image. This occurs due to an uninitialized memory read in the TGA image decoder, potentially exposing sensitive information.

The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered users.

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 does not verify that the vendor a commission calculation is requested for is the requesting vendor, allowing vendors to disclose the commission rate and fixed fee the marketplace administrator configured for other vendors.

The Envira Gallery WordPress plugin before 1.16.2 does not verify that an image identifier added to a gallery refers to a media attachment the caller is permitted to view, allowing any user able to create and edit a gallery (Author and above by default) to disclose the title and excerpt of other users' private, draft, pending and trashed posts that WordPress would otherwise withhold from them.

The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing unauthenticated users to disclose other customers' personal information and booking cancellation tokens.

The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting stored form submissions, allowing unauthenticated attackers to download the personal data (name, email, telephone, postal address, message) and payment metadata of everyone who submitted a payment form.

The Booking Calendar plugin for WordPress contains a vulnerability in versions up to and including 11.4.3 that allows unauthenticated attackers to access sensitive customer information. This exposure occurs via the wpbc_is_show_popover_in_flex_timeline() function and can leak names, email addresses, and phone numbers of customers who have made bookings. The vulnerability has a medium severity rating with a CVSS score of 5.3.

The Download Manager plugin for WordPress up to version 3.3.71 contains a vulnerability that allows authenticated users with subscriber-level access or higher to extract administrator session cookies via the 'first_name' parameter. This occurs when an administrator suspends the attacker's account, triggering a suspension email that includes the administrator's full Cookie header, enabling session hijacking and potential account takeover.

CVE-2026-103365 is a medium severity vulnerability in the Bookly Online Scheduling and Appointment Booking System WordPress plugin up to version 28.4. It allows unauthenticated attackers to access sensitive customer information by exploiting an endpoint that improperly validates requests and uses attacker-supplied identifiers to retrieve personal data. This exposure includes customer names, emails, phone numbers, and internal notes when certain placeholders are used in the booking form's Details step.

A vulnerability in 0xJacky's nginx-ui versions 2.0.0 through 2.4.x allows authenticated users to access sensitive node tokens via specific API endpoints. These tokens can be used to bypass cross-node authentication, enabling impersonation of trusted nodes within the cluster. This can expose sensitive management operations such as configuration synchronization and service restart. The issue is resolved in version 2.5.0.

The SendPress Newsletters WordPress plugin through 1.26.1.20 protects a logging endpoint with a hardcoded token that is the same on every site rather than a per-site secret, allowing unauthenticated users to read newsletter sending logs, including recipient email addresses.

Mechanize versions prior to 2.14.1 have a vulnerability where credential headers supplied by the caller are sent to a different host after an HTTP redirect. This occurs because Mechanize improperly reapplies request headers after redirects, potentially exposing bearer tokens or session cookies to an attacker controlling the redirect target. The issue does not affect Mechanize's cookie jar or authentication store. The vulnerability is fixed in version 2.14.1.

CVE-2026-107714 is a vulnerability in the sparklemotion mechanize library prior to version 2.14.1. It involves improper handling of HTTP redirects in Mechanize::HTTP::Agent#response_redirect, where redirects are treated as same-origin based only on host matching without consistent scheme and port comparison. This can cause sensitive headers like Authorization and Cookie to be sent over unencrypted HTTP or to unintended ports, potentially exposing credentials. The issue affects caller-supplied headers but does not impact integrity or availability. The vulnerability is fixed in version 2.14.1.

CVE-2026-83943 is a vulnerability in Microsoft Azure API Center that allows unauthorized actors to access sensitive information over a network. The flaw is classified under CWE-200, indicating exposure of sensitive information. The vulnerability has a high severity with a CVSS score of 8.7. Microsoft has issued an official fix for this cloud service vulnerability.

The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1.