The Team Members WordPress plugin before 9.3 does not perform any authorization or visibility check in an unauthenticated AJAX action that returns full team member records by ID, allowing unauthenticated attackers to enumerate and disclose details, including email addresses and phone numbers, of team members the administrator has not published publicly.
Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch resources only from repositories listed in the official plugin allowlist. When `ACTUAL_GITHUB_TOKEN` is configured, the proxy automatically attaches the server's GitHub token to GitHub requests. The GitHub API allowlist check uses a raw `startsWith()` prefix test for `/repos/{owner}/{repo}` without requiring a path boundary after the repository name. If an allowlisted public plugin repository is `https://github.com/acme/plugin`, the proxy also accepts GitHub API URLs. Those URLs are outside the allowlisted repository but still pass because their API path starts with `/repos/acme/plugin`. The proxy then forwards the request with the server's `ACTUAL_GITHUB_TOKEN`, allowing any authenticated Actual user to read private GitHub resources reachable by that token. Version 26.7.0 fixes the issue.
Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/actions.py and employee/not_in_out_dashboard.py render a user-controlled body at /recruitment/get-mail-preview/ and /employee/get-employee-mail-preview with the full request object in the Django template context. An authenticated user with a valid CSRF token can use template attribute traversal to read request.user.password, request.META, and related-user attributes, exposing password hashes, personal data, and server request metadata. Django template restrictions prevent arbitrary code execution through this primitive, so the demonstrated impact is information disclosure and possible offline password cracking or account compromise. This issue is fixed in versions 1.6.0 and 2.0.0.
CVE-2026-91766 is a medium severity vulnerability in PHP where the http:// stream wrapper forwards sensitive headers such as Authorization, Cookie, and Proxy-Authorization unchanged when following redirects. This occurs even if the redirect target is a different host, port, or downgrades from HTTPS to HTTP, potentially exposing credentials to unintended servers.
CVE-2026-100379 is a medium severity vulnerability in the Wikimedia Foundation's Wikipedia Android App that allows unauthorized actors to access, intercept, or modify HTTP cookies. This exposure of sensitive information could potentially lead to privacy issues or session hijacking. No specific affected versions or patches are currently detailed.
CVE-2026-100377 is a medium-severity vulnerability in the Wikimedia Foundation's Mediawiki WikiLambda Extension version 1.47.0-alpha. It involves exposure of sensitive information to unauthorized actors. The issue has been fixed in the master branch of the codebase. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a network-exploitable flaw with low complexity and no required privileges or user interaction.
CVE-2026-67406 is a vulnerability in rabbitmq-server versions prior to 4.3.3, 4.2.9, 4.1.14, and 4.0.23 where the Shovel worker process does not properly format crash logs. This causes plaintext AMQP credentials to be exposed in error logs when the shovel worker crashes, which can happen during network issues. The issue affects multiple version branches and is fixed in the specified patched versions.
CVE-2026-67410 is a vulnerability in RabbitMQ server versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2 where the OAuth2 client secret is exposed via an unauthenticated JavaScript endpoint. This occurs when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow uses a client secret. The secret is included in the JavaScript served by the unauthenticated endpoint /js/oidc-oauth/bootstrap.js, allowing any user who can access the management UI port to retrieve it. The issue is fixed in versions 4.2.9 and 4.3.3.
Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/stream. In a simple-auth deployment using per-user filters, any authenticated restricted account can receive resource telemetry and lifecycle events for containers outside its authorized label scope. The exposed data includes container names, images, full label maps, CPU and memory use, network and disk totals, and deployment or restart activity across monitored hosts, but does not include log contents, environment values, or exec access. This issue is fixed in version 10.6.7.
TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns days, assignments, dayNotes, and places through GET /api/shared/:token even when the trip owner disables share_map. The client hides the map, but the public JSON response still includes the itinerary and place names, coordinates, addresses, descriptions, notes, and prices. Anyone holding the valid share token can therefore read location and route information that the owner explicitly chose not to share, although the random token remains required and the flaw does not permit modification. This issue is fixed in version 3.3.0.
CVE-2026-77321 is a vulnerability in mauriceboe TREK, a collaborative travel planner, affecting versions prior to 3.3.0. The get_trip_summary tool improperly returns trip summary data without verifying the required trips:read scope, allowing tokens with unrelated scopes (e.g., weather:read) to access sensitive trip metadata, member email addresses, itinerary days, and accommodations. Although cross-user authorization is enforced, the missing scope check exposes trip content and third-party contact information beyond the intended least-privilege boundary. This issue is fixed in version 3.3.0.
Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor report HTTP server started by `@rsdoctor/rspack-plugin` binds to all network interfaces (`0.0.0.0`) and serves a `POST /api/data/key` endpoint with no authentication and wildcard CORS (`Access-Control-Allow-Origin: *`). Any network-adjacent or remote attacker can send a single unauthenticated request to retrieve the full source code of all compiled JavaScript modules (`moduleCodeMap`), serialized build configuration (`configs`), error details, and other sensitive build metadata. This server is enabled by default in non-CI environments, requiring no special configuration from the victim developer. Version 1.5.16 patches the issue.
phpMyFAQ versions prior to 4.2.0-alpha contain an authenticated SQL LIKE wildcard injection vulnerability in the chat user search feature. This flaw allows any logged-in user to bypass the intended display-name search filter and enumerate active users by exploiting unescaped SQL LIKE wildcards '%' and '_'. The issue is fixed in version 4.2.0-alpha.
authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets. Affected configurations include one-time code delivery by mail or SMS, outbound provisioning targets, device trust integrations, identity sources, the Kubernetes outpost integration, applications using a client or shared secret, and applications using a proxy provider. Deployments are affected when view permission is granted to accounts that are not intended to read these credentials; deployments where every viewer is permitted to read them are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2.
CVE-2026-76907 is an information exposure vulnerability in the suitenumerique docs platform versions 4.8.2 through before 5.4.0. It allows unauthenticated users to enumerate document identifiers, titles, creator data, timestamps, and metadata by exploiting predictable document path values in the search API. Authenticated users can also discover documents accessible via authenticated links, though restricted documents remain protected. The issue is fixed in version 5.4.0.
The Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.20.0 via the editor_assets function, which exposes the uag_insta_linked_accounts option through the uagb_blocks_info object without a capability check. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including raw Instagram Graph API access tokens configured by an administrator. Exploitation requires the Spectra Pro plugin to be active with a linked Instagram account.
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
The Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to retrieve the correct answers for any quiz on the site, including quizzes in courses they are not enrolled in. The redaction that hides them is applied only to a fixed list of question types, so the answers to every other type are returned in full to anyone able to view the questions.