CWE-200: Information Exposure vulnerabilities

The Otter Blocks plugin for WordPress versions up to 3.2.6 has a vulnerability that allows authenticated users with subscriber-level access or higher to access sensitive information. Specifically, these users can retrieve email addresses of the five most recent form submitters, their submission dates, and the total form submission count via the 'otter_form_widget_filter' parameter. This exposure occurs whenever the form feature is used on a site, making it a risk for sites utilizing the plugin's form blocks.

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.

CVE-2026-90988 is a medium severity information exposure vulnerability in the Request a Quote WordPress plugin up to version 2.5.6. The flaw arises because an unauthenticated AJAX handler does not perform authorization checks, allowing any unauthenticated user to access contact records of quote-request submissions, including unpublished records.

CVE-2026-64892 is a medium severity vulnerability in Johnson Controls Easy IO Neo that allows exposure of sensitive information by collecting data from common resource locations. It affects versions before 3.3b63. The vulnerability requires high privileges and user interaction but has low complexity and no network impact on integrity or availability.

CVE-2026-47360 is a high-severity vulnerability in Apache HTTP Server's mod_session_cookie module affecting versions 2.4.0 through 2.4.68. The flaw allows exposure of sensitive session cookie information to unauthorized actors due to improper handling of the SessionCookieRemove setting during internal redirects. This can result in session cookies being passed incorrectly to backend servers.

HCL BigFix Service Management has an information disclosure vulnerability where sensitive information is returned in error messages when invalid inputs are sent to certain API endpoints. This exposure could potentially aid attackers in crafting further attacks. The vulnerability has a low severity score of 3.7 and does not involve privilege or user interaction requirements.

HCL BigFix Service Management contains an information disclosure vulnerability due to an exposed API endpoint that reveals sensitive internal database information. This exposure could allow unauthorized actors to gain data that might assist in launching targeted database attacks. The vulnerability has a CVSS score of 5.3, indicating a medium severity level.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks.

HCL BigFix Service Management is affected by an Information Disclosure vulnerability, which could allow an unauthenticated attacker to analyze publicly accessible JavaScript files, enabling the discovery of hidden administrative API endpoints for further targeted exploitation.

The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials.

The WP Popular Posts WordPress plugin versions up to and including 7.4.2 have a vulnerability that allows unauthenticated attackers to access sensitive information from non-public post objects. This occurs because the plugin's REST API endpoint improperly permits access without proper permission checks, exposing fields such as raw title, content body, password, meta, status, and guid. The vulnerability arises from the 'context' parameter being passed directly to WordPress core functions without enforcing access controls.

CVE-2026-102121 is a high-severity vulnerability in Kiteworks Secure Data Forms where an unauthenticated form-rendering interface exposes more data than intended. Published forms accessible to anonymous users could leak the form owner's account profile and some deployment configuration details, but no passwords, authentication tokens, or multi-factor authentication secrets were exposed.

CVE-2026-47514 is a vulnerability in the NVIDIA GeForce GPU Display Driver for Windows and Linux. It exists in the kernel mode layer and allows a user to cause exposure of kernel stack contents, including sensitive data such as return addresses and pointers. Exploitation could lead to code execution, denial of service, privilege escalation, information disclosure, and data tampering. The vulnerability has a high severity with a CVSS score of 7.8. No specific affected versions or patch information are provided.

CVE-2026-13719 is a vulnerability in Grafana Enterprise that allows an authenticated user to list alert rules stored in folders they are not authorized to access via the alert rules API. If the user has no folder read permissions, the restriction is bypassed, exposing all alert rules in the organization. Starting from Grafana 13.1.0, any user can trigger this using a folder filter. The exposed information includes rule configuration but does not include data source credentials.

The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to download the name, email address and billing address of every customer who has booked a course.

The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.

The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.

The Connections Business Directory WordPress plugin through 10.4.67 does not apply its visibility and moderation-status restrictions on certain REST API read endpoints, allowing unauthenticated attackers to retrieve directory entries that are marked private or unlisted, or that are still pending moderation, including entry names, organizations, biographies, internal notes and street addresses. The Connections Business Directory WordPress plugin through 10.4.67 has been closed on WordPress.org and no fixed version is available, so site owners should remove it or restrict unauthenticated access to its REST API routes.