CWE-200: Information Exposure vulnerabilities

CVE-2026-59655 is a vulnerability in Apache CloudStack's OAuth authentication plugin that allows exposure of sensitive information to unauthorized actors when listing OAuth providers. This affects versions from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.

CVE-2026-59780 is a high-severity vulnerability in Apache CloudStack's LDAP authentication plugin that allows exposure of sensitive information to unauthorized actors. The issue arises because any authenticated user with access to the listLdapConfigurations API can list LDAP configurations, and this API is by default accessible to all default roles. This affects Apache CloudStack versions from 4.2.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The vulnerability is fixed in versions 4.20.3.1 and 4.22.1.1 or later.

CVE-2026-61397 is a high severity vulnerability in Apache CloudStack affecting the OAuth2 authentication plugin and Google OAuth integration. It allows exposure of sensitive information to unauthorized actors. The issue affects versions from 4.19.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Fixed versions are 4.20.3.1 and 4.22.1.1.

CVE-2026-65613 is a vulnerability in Apache CloudStack's Webhook module that allows exposure of sensitive information to unauthorized actors during listing and deleting deliveries. It affects versions from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later. The vulnerability has a medium severity with a CVSS score of 4.3.

A vulnerability in the Duplicate Post WordPress plugin before version 1.5.6 allows users with delegated roles to access post content, metadata, and passwords without proper capability checks. This includes unauthorized access to private and draft posts. The issue is classified as an information exposure vulnerability (CWE-200).

A vulnerability in the Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before version 5.0.14 allows unauthenticated users to access per-vendor commission configuration data via a REST endpoint. This exposure includes the vendor's commission type and, if category-based commissions are used, the specific per-category and default commission rates. The issue is classified as an information exposure vulnerability (CWE-200).

CVE-2026-17060 is a high-severity vulnerability affecting IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1. It allows a remote attacker to obtain sensitive information and cause a denial of service due to a kernel heap over-read. The vulnerability does not require user interaction or privileges to exploit. No patch information is currently provided.

CVE-2026-16973 is a vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1, where a local attacker can disclose sensitive kernel memory due to an out-of-bounds read. This exposure of sensitive information could allow unauthorized access to confidential data. The vulnerability has a medium severity rating with a CVSS score of 5.5.

CVE-2026-16964 is a medium severity vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS 4.1. It involves the exposure of sensitive information to unauthorized actors, which could allow a remote attacker to intercept messages and forge replies. The vulnerability is classified under CWE-200, indicating an exposure of sensitive information. There are no known exploits in the wild, and no official patch or remediation details are provided in the available data.

Kerberos Agent versions prior to 3.6.26 expose sensitive Hub credentials via custom HTTP headers during upload. The agent sends private and public keys in headers that are not stripped on cross-host HTTP redirects, potentially leaking the private key to unintended third parties. This issue is fixed in version 3.6.26 by implementing a redirect policy that strips these sensitive headers on cross-host redirects.

CVE-2026-67448 is a vulnerability in axllent mailpit versions 1.29.0 through 1.30.5 involving improper handling of URL encoding in WebSocket origin checks. The origin check relies on the raw request URI prefix, but Go's ServeMux routes on the percent-decoded path, allowing an attacker to bypass origin validation by encoding the path. This leads to unauthorized WebSocket connections that can leak sensitive email data. The issue arises because the upgrader accepts all origins and the middleware origin check is bypassed due to inconsistent handling of encoded URLs.

CVE-2026-53586 is a vulnerability in libgit2's built-in HTTP transport prior to versions 1.8.6 and 1.9.5. The issue involves improper handling of HTTP redirects and credential callbacks, causing sensitive HTTP Basic credentials or personal access tokens to be exposed to unauthorized actors if an attacker controls a trusted Git host or an open redirect. This vulnerability is fixed in libgit2 versions 1.8.6 and 1.9.5.

HCL IntelliOps Event Management (IEM) version 1.4.0 has a vulnerability due to missing or insecure Cross-Origin Security headers. This weakness can lead to unauthorized external interactions with the application environment and resources, potentially exposing sensitive information. The vulnerability is classified under CWE-200, indicating exposure of sensitive information to unauthorized actors. The CVSS v3.1 score is 4.8, reflecting a medium severity level. There are no known exploits in the wild and no official patches or fixes have been provided yet.

Etherpad versions from 2.6.0 up to but not including 3.1.0 contain a vulnerability in the token transfer mechanism. The POST /tokenTransfer endpoint stores an author token without expiration or removal after use, and the GET /tokenTransfer/{uuid} endpoint exposes this token. An unauthenticated attacker who obtains the transfer UUID can repeatedly redeem it to obtain fresh author cookies and impersonate the author for pad read and write operations. This issue is fixed in version 3.1.0.

Leantime JSON-RPC API versions up to 3.8.0 have a missing authorization vulnerability in the JSON-RPC dispatcher. This flaw allows authenticated users to invoke service-layer methods without proper permission checks, enabling actions such as modifying other users' accounts and resetting passwords. The vulnerability arises from the dispatcher not enforcing centralized authorization, distinct from other known CVEs affecting Leantime. This can lead to account takeover and full compromise of affected user accounts.

Grav is a file-based Web platform. Prior to 2.0.2, the Grav Twig content sandbox permits grav.offsetGet('config') to return the raw configuration object and permits json_encode, print_r, yaml_encode, and string filters to serialize that object without passing through GravSecurityPolicy::checkMethodAllowed. A user with page-author permissions can render sandboxed content that exposes plugins.* configuration secrets, including SMTP credentials, API keys, and plugin database credentials. This issue is fixed in version 2.0.2.

CVE-2026-53452 is a path traversal vulnerability in sgoudelis ground-station prior to version 0.4.13. It allows unauthenticated attackers to read arbitrary files outside the intended directory by exploiting improper validation of a pathname used in SDR configuration commands. The vulnerability requires the presence of readable JSON metadata files and associated data files to disclose contents. This issue is fixed in version 0.4.13.

CVE-2026-19782 is a medium severity information exposure vulnerability in the WPS Bidouille WordPress plugin versions before 1.33.5. The flaw arises from missing proper authorization checks in an AJAX action, allowing any authenticated user, including low-privilege roles like subscribers, to retrieve email addresses of all registered users.

CVE-2026-19406 is an information exposure vulnerability in the Easy Appointments WordPress plugin versions 3.12.28 up to but not including 4.0.1. The plugin's appointment-listing REST endpoint does not properly restrict access to appointment records by user, allowing users with contributor-level access to view all bookings on the site, including customer names, schedules, and statuses.

TrueBooker WordPress plugin versions before 1.2.7 contain an information exposure vulnerability due to missing authorization checks in some AJAX actions. This flaw allows unauthenticated users to access personal customer data such as names, email addresses, phone numbers, and postal addresses. The vulnerability has a medium severity rating with a CVSS score of 5.3.