CWE-200: Information Exposure vulnerabilities

The WP Directory Kit WordPress plugin versions prior to 1.5.7 contain an information exposure vulnerability. This flaw arises because one of the plugin's public AJAX actions does not perform authorization checks, allowing unauthenticated attackers to retrieve usernames and email addresses of users assigned roles by the plugin. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-53959 is a vulnerability in RARgames 4gaBoards prior to version 3.3.9 that allows any authenticated user to enumerate and retrieve sensitive account information of all users. The exposed data includes email addresses, phone numbers, organization details, admin status, and SSO-linked emails. This flaw arises because the API endpoints /api/users and /api/users/:id lack proper authorization checks and response sanitization. The vulnerability enables privacy breaches and facilitates targeted phishing attacks. It is fixed in version 3.3.9.

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0.

CVE-2026-68520 is a medium severity vulnerability in the open-source system monitoring tool Glances. Versions prior to 4.5.6 have a flaw in the as_dict_secure() function in glances/config.py, which insufficiently checks option names and inadvertently exposes sensitive information such as public_username and credentials embedded in public_api values. This exposure occurs via unauthenticated GET requests to /api/4/config and /api/4/config/ip endpoints. The issue has been fixed in version 4.5.6.

A vulnerability in Apple Safari allows visiting a maliciously crafted website to leak sensitive data. The issue is fixed in Safari 26.6.1 and corresponding versions of iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. The vulnerability has a medium severity with a CVSS score of 6.5 and involves unauthorized disclosure of information without integrity or availability impact.

Onyx versions prior to 3.1.10, 3.2.14, and 4.0.0 contain a vulnerability where certain API endpoints expose another user's OAuth Authorization header to unauthorized BASIC_ACCESS users. This occurs due to per-user tokens being copied into a shared admin configuration and then returned in API responses. The issue has been fixed in versions 3.1.10, 3.2.14, and 4.0.0.

CVE-2026-57485 is a high-severity vulnerability in Stirling-Tools Stirling-PDF prior to version 2.9.0. It involves exposure of a sensitive API key (STIRLING-PDF-BACKEND-API-USER) to authenticated users with ROLE_USER privileges via the /api/v1/user/get-api-key endpoint. This key allows impersonation of an internal service account, bypassing rate limits and accessing internal endpoints. The issue is fixed in version 2.9.0.

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"), allowing an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs. This issue is fixed in version 1.0.0-rc.7.

Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Permission control vulnerability in the notification service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

CVE-2026-49307 is a permission control vulnerability in the multi-mode input module of Huawei HarmonyOS version 6.1.0. Successful exploitation can lead to unauthorized exposure of sensitive information, impacting service confidentiality. The vulnerability has a CVSS score of 6.2, indicating a medium severity level. There is no public information about available patches or official remediation. No known exploits are reported in the wild.

The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not have authorisation checks in some of its REST API endpoints, allowing unauthenticated users to retrieve the title, type, size and URL of the media attachments assigned to any of its folders, including folders which are not published in any gallery on the site.

The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post metadata from posts they do not own, including private and draft ones.

The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration (rules, filters and field mapping) and to enumerate the full product category taxonomy.

The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.

Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

CVE-2026-18068 is a medium severity vulnerability in IBM i versions 7.3, 7.4, 7.5, and 7.6. It involves a confusion between byte-count and element-count that could allow a remote attacker with limited privileges to obtain sensitive information. The vulnerability does not impact integrity or availability and does not require user interaction. No official patch or remediation guidance is currently confirmed.

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key material that they should not be authorized to view.

CVE-2026-58511 is a low-severity information disclosure vulnerability in Gitea Open Source Git Server versions up to 1.26.4. The issue involves the webhook authorization header being returned in plaintext via the API, which could expose sensitive authorization information. There is no indication of active exploitation or public exploit code. No patch or official fix information is provided.

CVE-2026-58510 is a medium severity vulnerability in Gitea Open Source Git Server affecting versions up to 1.26.4. The issue involves a failure to apply a fix (GHSA-8fwc-qjw5-rvgp) to the API EditRepo path, resulting in stale repository watches persisting when a repository's visibility changes from public to private. This can lead to unintended information disclosure due to retained watch states.