The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data (id, username, email address and registration date) of registered users.
The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve.
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.
CVE-2026-102709 is a vulnerability in Eclipse ThreadX versions 6.0.1 through 6.5.2.202603 affecting TrustZone-M ports. It involves insecure handling of a thread pointer from non-secure code, allowing unauthorized access to secure memory. This flaw can lead to exposure of secure-world secrets such as cryptographic keys and breaking of TrustZone-M isolation.
A vulnerability in the Wikimedia Foundation Mediawiki CentralAuth Extension allows unauthorized actors to access sensitive information. This exposure affects all versions prior to 1.46.1, including 1.45.5 and 1.43.10. The issue has a high severity rating with a CVSS score of 7.5. A fix is available in version 1.46.1.
CVE-2026-100241 is a vulnerability in the Wikimedia Foundation's Mediawiki EventBus Extension version 1.47.0-alpha that allows unauthorized exposure of sensitive information. The flaw is classified under CWE-200, indicating information disclosure to unauthorized actors. The vulnerability has a high severity with a CVSS score of 7.5, reflecting network attack vector, low complexity, no privileges required, and no user interaction needed. There is no indication of active exploitation in the wild or available patches at this time.
Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request.
CVE-2026-22101 is a medium severity vulnerability in the EVbee DC-80 device. It allows access to a service menu that is obfuscated but accessible with physical access. This service menu exposes sensitive information including serial numbers, MAC addresses, and WiFi network credentials. The vulnerability affects versions from 0 up to but not including 1.5.6. There is no indication of a patch or official fix available at this time.
A critical vulnerability (CVE-2026-100810) was identified in the DevTools component of Mozilla Thunderbird. This issue allows for high impact on confidentiality, integrity, and availability. The vulnerability was fixed in Thunderbird version 157.
PyJWT versions prior to 2.14.0 contain a vulnerability in the PyJWKClient component where HTTP redirects during JWKS fetching are followed without validating the redirect destination. This can lead to exposure of sensitive request headers and allow an attacker-influenced redirect to poison JWKS trust, potentially causing acceptance of forged JWTs. The issue requires an attacker to influence the configured JWKS endpoint's response and is not triggered by token key IDs alone. The vulnerability is fixed in PyJWT 2.14.0.
A security vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. Impacted is an unknown function in the library encryptionhelper.dll. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Apache Roller 6.1.5 contains a vulnerability that allows a weblog administrator to read sensitive files on the application classpath, including configuration files with secrets. This is possible because the Velocity template engine's include and parse directives are not confined by the sandbox that treats weblog administrators as untrusted. The issue is fixed in Apache Roller 6.1.6, which restricts includes to the active theme and removes classpath resource loading from weblog rendering.
CVE-2026-92995 is a medium severity vulnerability in the Verge3D Publishing and E-Commerce WordPress plugin up to version 4.13.0. It allows unauthenticated users to download digital goods files attached to any order without authorization due to insufficient access restrictions on a file-download handler.
CVE-2026-82841 is an information exposure vulnerability in the UpdraftPlus: WP Backup & Migration Plugin for WordPress. Versions from 1.23.8 up to but not including 1.26.8, and from 2.23.8 up to but not including 2.26.8.26, do not perform capability checks in a routine that outputs stored remote storage settings on admin pages after a specific post-migration state. This flaw allows any authenticated user, including low-privilege roles like subscribers, to access sensitive credentials such as passwords and secret keys for backup destinations.
Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicitly enabled — page content authored by a user holding only page-write permission is rendered through a Twig sandbox that allowlists get_cookie(), which returns any cookie sent with the current request, including the visitor's session cookie. Because the read occurs server-side via filter_input(INPUT_COOKIE, ...), the HttpOnly, Secure and SameSite attributes offer no protection. Grav then stores the finished post-Twig output in a page-content cache keyed only on page identity and the configuration checksum, with no session, user or request dimension and no bypass for authenticated visitors. A page published by a page-write user can therefore capture the session identifier of the next administrator who views it, after which the cached output serves that identifier to unauthenticated visitors, who can replay the cookie to authenticate as that administrator. Since 2.0.19, security.twig_content.process_enabled defaults to true and Security::applyTwigContentDefault() derives each page's process.twig flag from that gate, so content Twig runs on every page with no frontmatter or operator action. Fixed in 2.0.25; 1.7.x is outside the backport scope.
CVE-2026-96526 is an information exposure vulnerability in the MCP Server for WordPress plugin versions before 1.8.2. It allows users with the Contributor role to access the title and publication status of any post, page, or custom post type, including private, draft, pending, and scheduled content, without proper authorization checks.
The File Manager WordPress plugin versions from 7.2.2 up to but not including 8.0.5 contain an information exposure vulnerability. Unauthenticated users can download database backup archives, which may be stored under a fixed filename. This can lead to exposure of sensitive data such as user email addresses and password hashes on servers that do not enforce .htaccess protections for the directory.