CWE-200: Information Exposure vulnerabilities

CVE-2026-77754 is a medium severity information exposure vulnerability in the Kirki WordPress plugin before version 6.0.14. The plugin fails to perform capability checks on certain public AJAX endpoints, allowing unauthenticated users to access email addresses of registered users and comment authors, as well as non-public page content and settings.

Typebot.io versions prior to 3.18.0 contain a vulnerability in the server-side Send Email integration block that allows arbitrary reading of local files on the server. This occurs because the parseAttachments helper accepts local filesystem paths without proper validation, enabling any registered user to send email attachments containing sensitive server files. The vulnerability does not require administrative privileges or victim interaction and can expose secrets such as credential encryption keys and database connection strings. The issue is fixed in version 3.18.0.

A vulnerability in the PyOpenEXR Python bindings of the AcademySoftwareFoundation's OpenEXR library allows exposure of uninitialized heap data when reading crafted deep scanline EXR files with layer-prefixed RGB channels. This occurs in versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13. The issue results from incorrect lane-offset calculations that cause some channel data to be uninitialized and returned, potentially exposing sensitive same-process heap contents. The flaw is fixed in versions 3.3.13 and 3.4.14.

A vulnerability in the node-modules urllib HTTP client for Node.js allows sensitive authorization headers and tokens to be sent to attacker-controlled redirected origins due to improper reuse of request options across different origins during redirects. This can expose credentials such as Authorization, Cookie, Proxy-Authorization, and various API tokens without user interaction. The issue affects versions prior to 2.44.1 and 4.9.1 and has a high severity rating.

HCL Software Hive version 1.0 contains an information disclosure vulnerability (CVE-2026-21758) that could allow an attacker to obtain sensitive information about the host environment. The vulnerability has a low severity rating with a CVSS score of 3.7 and does not involve privilege or user interaction. No known exploits are reported in the wild, and no patch or remediation details are currently provided.

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upgrade to version 1.20.0, which fixes the issue.

FiboSearch WordPress plugin versions before 1.34.1 have a vulnerability where unauthenticated AJAX endpoints expose password-protected products and their metadata without requiring the product password. This affects the autocomplete search and Details Panel endpoints, allowing unauthorized users to enumerate sensitive product information.

CVE-2026-47735 is a path traversal vulnerability in Basekick-Labs' Arc time-series database prior to version 26.06.1. The vulnerability arises because Arc's user-SQL validator only blocked certain DuckDB I/O functions via regex denylist, leaving many others unblocked. This allowed unauthorized file access through scalar table functions in SQL queries. The issue is fixed in version 26.06.1 by implementing a structural sandbox at the DuckDB layer that restricts file access to an allowlist and disables further extension installs or loads.

CVE-2026-48050 is a high-severity vulnerability in Basekick-Labs' Arc time-series database prior to version 26.06.1. The issue arises because the application registers Go's pprof debugging endpoints under /debug/pprof/* without proper authentication, allowing unauthorized access to sensitive profiling information. This exposure occurs due to the authentication middleware bypassing token checks for these endpoints. The vulnerability is patched in version 26.06.1. Workarounds include blocking access to /debug/pprof* at the reverse proxy or load balancer, restricting API port access via firewall rules, or disabling the pprof handler in the source code and rebuilding the application.

CVE-2026-34948 is a vulnerability in Combodo iTop, a web-based IT service management tool, where sensitive information could be exposed to unauthorized actors due to incomplete access checks in Object Query Language (OQL). Versions prior to 3.2.3 are affected. The issue has been fixed in version 3.2.3.

CrossWatch versions prior to 0.9.21 have an information exposure vulnerability where an unauthenticated GET request to /api/app-auth/status returns metadata about all active sessions. This includes IP addresses, User-Agent strings, internal session IDs, and session timestamps. The issue is fixed in version 0.9.21.

CVE-2026-69225 is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier. It allows a remote, unauthenticated attacker to cause sensitive information to be reflected in an HTTP response body. The vulnerability is classified under CWE-200, indicating exposure of sensitive information to unauthorized actors. The CVSS v3.1 base score is 5.9, reflecting a medium severity level.

CVE-2026-69224 is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.1 through 12.0. Under difficult to reproduce conditions, a remote unauthenticated attacker may cause sensitive information to be reflected in an HTTP response body. The vulnerability has a medium severity rating with a CVSS score of 5.9.

Microsoft UFO versions prior to 3.0.8 contain a vulnerability where the FastMCP HTTP server bound to localhost:8010 does not validate Host, Origin, or Sec-Fetch-Site headers. This allows an attacker to use DNS rebinding to access the local /mcp endpoint, enumerate tool schemas, and invoke execute_command with a valid API key, potentially reading files or executing OS commands as the victim user. The issue is fixed in version 3.0.8.

Git for Windows versions prior to 2.55.0.windows.4 contain a vulnerability where a malicious remote Git server can cause the client to initiate outbound SMB connections during clone or fetch operations if transfer.bundleuri=true. This behavior can expose NTLM authentication credentials to an attacker-controlled host. The issue is resolved in version 2.55.0.windows.4.

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3.

Combodo iTop versions prior to 3.2.3 contain a vulnerability where unauthenticated users can access sensitive uploaded files via sniffed URLs. This issue is due to missing authentication controls on critical functions. The vulnerability has been fixed in version 3.2.3.

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects from server/src/controllers/statusPageController.ts. The response includes the secret field used by HttpProvider.ts as an HTTP Authorization credential, even though BaseStatusPage.tsx does not display that value, allowing visitors to extract credentials from the JSON response and use them against monitored services. This issue is fixed in version 3.9.2.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while listing and deleting deliveries. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

CVE-2026-50222 is a high-severity vulnerability in Apache CloudStack affecting userdata-related APIs. Several APIs lack proper authorization checks, allowing unauthorized access to userdata resources across tenants. Affected versions include 4.18.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The issue also affects the deleteCniConfiguration API introduced in 4.21.0.0. Fixed versions are 4.20.3.1 and 4.22.1.1 or later.