CWE-200: Information Exposure vulnerabilities

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ash_cloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts. AshCloak.Transformers.SetUpEncryption removes each cloaked attribute from the action's accept list and adds an action argument that carries the plaintext into the encryption change. That argument is built with sensitive?: attr.sensitive?, inheriting the flag from the source attribute, so a cloaked attribute declared without sensitive? true produces a non-sensitive argument. It is the only place the cleartext value lives, and the one place Ash will not redact: it appears verbatim in inspect(changeset), Ash.Error.Invalid and validation error messages, telemetry, :sys dumps, and error-tracker payloads. The generated encrypted attribute and decrypt calculation are already hardcoded sensitive. This issue affects ash_cloak: from 0.1.0 before 0.4.0.

CVE-2026-77007 is a high-severity information exposure vulnerability in the HEL Online Classroom WordPress plugin up to version 1.0.3. The plugin fails to perform authorization checks on a REST API route, allowing unauthenticated users to access stored settings, including a shared secret used for signing API requests to the connected BigBlueButton server. This exposure could allow attackers to obtain sensitive information without authentication.

CVE-2026-55485 is a high-severity vulnerability in piccolo_admin prior to version 1.14.0 that allows a non-superuser administrator to obtain another user's live session token via a GET request to the sessions API endpoint. This token can be replayed to impersonate a superuser and escalate privileges permanently. The issue arises because GET requests to user and session tables are allowed without superuser validation, and the session token is exposed as it is not treated as secret. The vulnerability is fixed in version 1.14.0.

A vulnerability in the User Frontend WordPress plugin before version 4.3.10 allows unauthenticated attackers to access the user directory search endpoint without restriction. This exposure enables attackers to retrieve email addresses and phone numbers of all registered users, including administrators.

CVE-2026-78174 is a critical vulnerability in WatchGuard Dimension version 2.0 where unredacted session identifiers for logged-in users are recorded in the web UI diagnostic log. A low-privileged Dimension Administrator can access this log and extract a Super Administrator's session token while the latter is logged in, potentially allowing account takeover.

TriliumNext Trilium versions up to and including 0.103.0 have a vulnerability in the public share-search endpoint that allows unauthenticated users to access titles, paths, and content of protected shared notes without enforcing share credentials or hidden status. This enables attackers to enumerate and read notes that should be password-protected. The issue is fixed in version 0.104.0.

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7

CVE-2026-78138 is a medium severity information exposure vulnerability in the Finale Lite WordPress plugin before version 2.21.0. The plugin fails to perform a capability check on an AJAX action that returns sales campaign configuration data for arbitrary post IDs. This allows any authenticated user with Subscriber or higher privileges to access campaign configuration and scheduling details that should be restricted.

LearnPress WordPress plugin versions up to and including 4.0.2 have a vulnerability where a REST endpoint does not perform authorization checks. This allows unauthenticated attackers to enumerate order identifiers and disclose the payment status of arbitrary orders. The issue is classified as an information exposure vulnerability (CWE-200).

CVE-2026-77017 is a high-severity information exposure vulnerability in the Workeera WordPress plugin before version 1.0.6. It allows users with minimal privileges (subscriber role) to read arbitrary files on the server, including sensitive files such as configuration files and authentication secrets. This occurs because the plugin does not restrict which profile values a candidate may submit nor confines stored file locations to allowed directories before serving them.

WP OAuth Server (Login with WordPress) plugin versions before 6.3.1 do not restrict access to its debug log, which is stored at a fixed, publicly accessible location. This allows unauthenticated users to read sensitive information including OAuth tokens, authorization codes, and user records with password hashes when debug logging is enabled. The vulnerability is identified as CWE-200 (Information Exposure).

Weblate versions prior to 2026.8 have a vulnerability where object-scoped RSS feeds do not enforce permission checks, allowing unauthorized users to access change-history metadata from private projects and restricted components. This metadata includes project and component identities, contributor usernames and full names, action types, timestamps, and translation or unit links, but not the translated-string content. The issue affects installations that allow anonymous access and use private or restricted projects. The vulnerability is fixed in version 2026.8.

Weblate versions prior to 2026.7 contain a vulnerability where authenticated users with project access can retrieve change history of restricted components via nested API endpoints without proper component-level access checks. This exposure allows unauthorized viewing of sensitive translation data. The issue is fixed in version 2026.7.

CVE-2026-47848 is a medium severity vulnerability in Spring Reactor Netty where the WebSocket client may leak credentials during handshake redirects to a different origin if the HTTP client is configured to follow redirects. This affects specific versions of Reactor Netty. No official patch or remediation guidance is currently confirmed.

CVE-2026-46371 is a SQL injection vulnerability in fleetdm fleet versions up to 4.84.1. It affects the Apple MDM commands listing endpoint, allowing an authenticated user with Observer role to extract sensitive data from joined database tables via a sort-order oracle attack. This includes host enrollment secrets and Apple Push Notification Service tokens. The flaw arises because the order_key parameter is not validated against an allowlist, enabling binary search extraction of sensitive values. With extracted keys, attackers can impersonate enrolled hosts and interact with Fleet's osquery and Orbit endpoints. The issue is fixed in version 4.84.2.

Fleet versions up to 4.84.1 have a SQL injection vulnerability in the labels host-listing endpoint that allows authenticated users with Observer role to extract host enrollment secrets. This flaw enables attackers to reconstruct long-lived shared secrets used for agent authentication, potentially impersonating hosts and manipulating device management data. The issue is fixed in version 4.84.2.

A vulnerability in fleetdm fleet versions prior to 4.87.0 allowed low-privilege users with Observer, Observer+, or Technician roles to access unmasked team enroll secrets and full team configuration, including sensitive credential-bearing agent options, via the target search endpoint. This exposure could enable unauthorized enrollment of hosts and disclosure of credentials such as AWS secret keys or proxy passwords. The issue is fixed in version 4.87.0.

Starlette-Admin versions prior to 0.16.1 have a vulnerability where the list API does not properly validate user-supplied order_by and structured where field names against allowed sortable and searchable fields. This allows authenticated users with access to list endpoints to bypass UI restrictions and sort or filter on unintended fields, causing limited exposure of sensitive information. Additionally, malformed field names can cause unhandled exceptions and HTTP 500 errors, resulting in limited denial of service. The issue is fixed in version 0.16.1.

The Simple Newsletter Plugin for WordPress before version 4.3.3 has an information exposure vulnerability. It does not verify that the requester is the subscriber before displaying stored subscriber details. This allows unauthenticated users to access personal subscriber data and the key that authorizes changes to their records.

The Stripe Payment Forms by WP Full Pay WordPress plugin before version 8.5.1 has an information exposure vulnerability. It does not properly verify that a customer portal session has completed its confirmation step before returning data. This flaw allows unauthenticated users to access another customer's subscription and billing information.