CWE-200: Information Exposure vulnerabilities

CVE-2026-58442 is a medium severity vulnerability in Gitea Open Source Git Server versions up to 1.26.4. It involves a server-side request forgery (SSRF) through repository migration, where a multi-answer DNS allow-list can be bypassed, potentially exposing sensitive information.

CVE-2026-58434 is a high-severity vulnerability in Gitea Open Source Git Server version 1.26.2 where private repository metadata remains accessible even after access revocation. This issue results in unauthorized disclosure of sensitive information despite intended access restrictions.

CVE-2026-58432 is a medium severity vulnerability in Gitea Open Source Git Server versions up to 1.26.4. It involves missing authorization and authorization bypass through user-controlled keys and incorrect permission assignments, leading to exposure of sensitive information to unauthorized actors.

CVE-2026-58427 is a high-severity vulnerability in Gitea Open Source Git Server where private organization member lists are leaked via the /members API endpoint. This issue represents an incomplete fix for a previous pull request (#38145), resulting in unauthorized disclosure of sensitive membership information. The vulnerability affects Gitea versions up to and including 1.26.4.

CVE-2026-58425 is a vulnerability in Gitea Open Source Git Server where OAuth token introspection improperly returns metadata of tokens issued to other clients, violating RFC 7662 section 4. This can lead to unauthorized disclosure of token metadata. The vulnerability affects Gitea versions up to and including 1.26.4. The CVSS score is 4.3, indicating a medium severity impact primarily on confidentiality.

CVE-2026-57897 is a medium severity vulnerability in Gitea Open Source Git Server versions up to 1.26.4. It involves cross-repository information disclosure via organization-level actions using the Run/Job APIs. The vulnerability allows an attacker with limited privileges to access sensitive information across repositories within an organization without proper authorization.

CVE-2026-55982 is a critical vulnerability in Gitea Open Source Git Server version 1.26.2 where the OIDC userinfo endpoint returns identity claims without properly enforcing API token scopes. This flaw allows unauthorized access to sensitive identity information. The vulnerability has a CVSS score of 9.1, indicating a high impact on confidentiality and integrity without requiring user interaction or privileges.

CVE-2026-50105 is a medium severity vulnerability in Gitea Open Source Git Server affecting versions up to 1.26.4. It involves RSS/Atom feed handlers bypassing API-token scope and public-only confinement due to an incomplete fix of a previous issue (#37698). This leads to unauthorized information disclosure (CWE-200) and improper access control (CWE-862).

: Exposure of Sensitive Information to an Unauthorized Actor : Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3.

: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions).. This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions).: All versions without Priwall v3.

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, and interpolate the result into an assignment prefixed to a command. An attacker who controls the input can supply a value such as :~ to disclose the home-directory path and may change the location on which the command operates. This issue is fixed in versions 2.1.14 and 3.0.1.

When kuma-dp is configured with the Envoy admin API on a Unix domain socket, which is the default, its readiness service on TCP port 9902 - bound to all interfaces - forwards almost the entire Envoy admin API to any caller that can reach the port, with no authentication. An attacker with network access to a data plane's port 9902, for example another pod on the cluster network, can read Envoy and data plane configuration without credentials: config dumps, cluster and listener lists, stats, and the mesh trust bundle. Exposure is read-only - destructive Envoy admin actions are blocked and private keys are not exposed.

A vulnerability in Fleet versions prior to 4.87.0 allowed low-privilege observer-class users to access unmasked team enroll secrets and credential-bearing configuration via the target search endpoint. This flaw exposed sensitive information such as AWS secret access keys and proxy passwords. The issue was due to insufficient sanitization on the target search endpoint, unlike other team-facing endpoints that masked these fields for observers. The vulnerability is fixed in version 4.87.0.

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was shown unmasked in the Variables UI. The exposure is limited to the UI: any authenticated user who can see the Variable in the UI can already read its full value through the Variables REST API, so this does not disclose data the user could not otherwise obtain — the masking is a shoulder-surfing defense for the UI, not an access-control boundary. This is an incomplete-fix follow-up to CVE-2026-42358, whose fix made only the dictionary walk unbounded; lists, tuples, and sets beyond the depth limit remained unmasked in the UI. Deployments that applied the CVE-2026-42358 fix should also upgrade to address this residual case. Upgrade to apache-airflow 3.3.1 or later.

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could read a team-scoped Celery broker URL, including its embedded credentials, in cleartext, while the equivalent global option was correctly masked. The secrets masker matched only base section and option names and did not normalize team-prefixed sections before the sensitivity check (CWE-200). This is a distinct masker bypass from CVE-2026-48828 and CVE-2026-48892: deployments that upgraded to apache-airflow 3.3.0 to address those issues remain affected by this team-scoped variant. Users are advised to upgrade to apache-airflow 3.3.1 or later, which normalizes team-scoped sections before masking.

phpMyFAQ version 4.2.0-alpha contains an authenticated SQL LIKE wildcard injection vulnerability in its chat user search API. This flaw allows any logged-in user to inject SQL LIKE wildcards (%) and (_) into search queries, bypassing intended display-name filtering and enabling enumeration of active user IDs and display names. The vulnerability is due to improper escaping of SQL LIKE metacharacters. A patch is available to address this issue. The vulnerability has a medium severity with a CVSS score of 5.4.

The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase totals of any customer whose email address they know or can enumerate.

The WPC Admin Columns WordPress plugin before 2.3.4 does not have authorisation checks in one of its AJAX actions, allowing users with a role as low as subscriber to read arbitrary user, post and term metadata, including data belonging to administrators.

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database. This is an incomplete fix of CVE-2020-36848, as the protection added at the time never took effect on distributed copies of the plugin.