CWE-200: Information Exposure vulnerabilities

CVE-2026-0305 is an information disclosure vulnerability in the Palo Alto Networks Prisma Access Agent on Linux. It allows a local user to access sensitive configuration data and credentials. Other platform versions of the agent (macOS, Windows, iOS, Android, Chrome OS) are not affected. The vulnerability has a medium severity rating and a CVSS 4.0 base score of 4.3. A fix is available in version 26.2.

The Kirki WordPress plugin before 6.3.0 does not check whether the requester is allowed to read a post before rendering and returning its page content, allowing unauthenticated users to retrieve the content of pages that are not publicly available, such as private, draft, pending and trashed ones.

The SupportCandy WordPress plugin before 3.5.3 does not validate a submitted per-ticket authorization code before disclosing the real code to the requester, allowing unauthenticated users to read the contents of any support ticket.

The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers.

The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers.

The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers.

The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see, allowing unauthenticated users to read arbitrary user records (including email addresses and roles) and arbitrary site options.

Eclipse aeriOS's Identity Manager deployment in its current development version had insecure default configurations and credentials, exposing Keycloak and PostgreSQL services via Kubernetes NodePort and Docker Compose. Default fixed credentials allowed administrative access, risking unauthorized access or modification of identity data. The issue is addressed by randomizing passwords, using Kubernetes Secrets, restricting service exposure, and warning against using predefined development users in production.

CVE-2026-69806 is a high-severity vulnerability in Microsoft .NET 10.0 runtime that allows exposure of sensitive information to unauthorized actors. This flaw enables an authorized attacker with local access to elevate their privileges. The issue affects multiple versions of the .NET runtime prior to fixed releases. Official patches are available to remediate this vulnerability.

CVE-2026-69805 is a high-severity vulnerability in Microsoft Visual Studio 2022 version 17.14 involving external control of file name or path in .NET. This flaw allows an unauthorized attacker to elevate privileges over a network. The vulnerability affects specific versions prior to 17.14.40 and 18.9.3, and has an official fix available.

CVE-2026-68852 is a vulnerability in Microsoft Windows 10 Version 1607 involving the use of an uninitialized resource in the Microsoft Account component. This flaw allows an authorized local attacker to disclose sensitive information. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. A patch is available and has been officially released by Microsoft.

CVE-2026-69862 is an out-of-bounds read vulnerability in the Windows Wireless Wide Area Network Service affecting multiple versions of Microsoft Windows 10. This flaw allows an authorized local attacker to disclose information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released to address this issue in the affected Windows 10 versions.

CVE-2026-69549 is an out-of-bounds read vulnerability in the Virtual Hard Disk (VHD) Miniport Driver of Microsoft Windows 10 Version 1809 and related builds. This flaw allows an authorized local attacker to elevate privileges on the affected system. The vulnerability has a high severity rating and has been officially fixed in multiple Windows 10 builds.

An information disclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users.  Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user process to perform improper GPU memory processing operations to gain access to sensitive kernel information. This issue affects Valhall GPU Kernel Driver: from r29p0 through r49p5, from r50p0 through r54p3, r55p0; Arm 5th Gen GPU Architecture Kernel Driver: from r41p0 through r49p5, from r50p0 through r54p3, r55p0.

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account. This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.

The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role.

The Events Calendar WordPress plugin before 6.17.3.1 does not restrict non-public content to the users entitled to read it on its public REST archives, allowing users with a low-privilege role such as contributor to read the full contents of every unpublished record on the site, including other users'.

The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login.

The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it.