The WP Directory Kit WordPress plugin before 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to retrieve stored contact messages and associated user data belonging to other users.
The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.
The WP Statistics WordPress plugin before 14.16.10 does not perform a capability check on a set of dashboard analytics AJAX handlers, relying only on a nonce that every authenticated user holds, allowing users with Subscriber-level access and above to disclose the site's visitor analytics data.
Element Call is a native Matrix video conferencing application. Versions 0.5.17 through 0.19.3 report analytics data to a PostHog server, when configured to by a `posthog` key in config.json or by the `posthogApiHost` and `posthogApiKey` URL parameters. Several fields of this data (`$initial_person_info`, `$session_entry_url`, and `$current_url`) were found to contain the full URL of the user's visited page, including the fragment. Users of a standalone Element Call ‘SPA’ instance such as https://call.element.io may therefore have reported the full URLs of certain calls, including encryption passwords, to the configured PostHog server, potentially compromising the confidentiality of the calls to actors who could access both the PostHog analytics data and the encrypted media streams. The same issue is present in Element Call's embedded package, but in practice it does not impact applications using this package (including Element Web, Element Desktop, Element X iOS, and Element X Android) because they distribute encryption keys over Matrix rather than encoding a password in the URL. The issue is patched in Element Call 0.19.4. Some workarounds are available. Users may opt out of analytics in the 'Feedback' tab of Element Call's settings and create new links for future calls. Admins who host Element Call as a standalone application may disable PostHog analytics entirely by removing the `posthog` key from their deployment's config.json file.
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, an intermediary must remove the header fields listed in a message's Connection header field before forwarding the message, in addition to the well known hop by hop headers, but the proxy() function only removed the well known hop by hop headers, including Connection itself, from origin responses. A client may therefore receive response headers that the origin intended only for its immediate peer, disclosing connection scoped or internal metadata contained in such headers, when an application proxies responses from an origin that declares additional, non standard headers as hop by hop via the Connection response header. This issue is fixed in version 4.12.34.
In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the user's Datadog UUID, with no user-facing opt-out.
Impact: The Datadog user UUID and crash data are visible within Firebase Crashlytics. This UUID is not identifying outside Datadog's own systems.
Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds
with memory. By repeatedly
requesting this endpoint, an attacker can access sensitive
information, including user passwords. Exploitation does not require
authentication. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
The Password Protected WordPress plugin before version 2.8.4 has a vulnerability that allows unauthenticated users to bypass the sitewide password protection via the REST API when a specific option is enabled. This issue re-introduces a previously fixed flaw that was patched in version 2.6.7 but regressed in 2.6.8. The vulnerability permits unauthorized reading of protected content and account identifiers.
OpenReception appointment booking software versions prior to 1.0.5 contain a vulnerability where an unauthenticated API endpoint discloses sensitive information about private channels. The /api/tenants/{id}/schedule endpoint returns details of all non-archived channels regardless of their intended visibility, exposing channel names, descriptions, IDs, agent associations, and availability. This issue is fixed in version 1.0.5.
Statamic CMS versions prior to 5.74.1 and 6.24.0 contain a vulnerability where an authenticated Control Panel user can verify the existence of an email address via a user creation wizard endpoint without having permission to view users. This exposure is limited to user existence information and does not disclose other user data. The issue is fixed in versions 5.74.1 and 6.24.0.
A vulnerability in langgraph's checkpoint saver implementations for Postgres and SQLite allows an authenticated user to access stored items belonging to other tenants or users due to improper namespace scoping. This occurs because hierarchical namespaces are persisted as dot-joined strings and reads are scoped by prefix matching, which can overlap with sibling namespaces or those containing unescaped pattern metacharacters. The issue affects versions prior to 3.1.1 and is fixed in version 3.1.1.
OpenReception appointment-booking-software versions prior to 1.0.2 expose the full tenant database connection string to authenticated TENANT_ADMIN users via the GET /api/tenants/{id} endpoint. This connection string includes credentials with superuser privileges by default, allowing a TENANT_ADMIN to access and manipulate all tenant databases and the central administrative database, breaking tenant isolation. Version 1.0.2 addresses this issue.
CVE-2026-5336 is a vulnerability in the DataPress (Dataverse Integration) WordPress plugin before version 2.91. It improperly restricts access to its template rendering feature, allowing users with Contributor roles to disclose sensitive information such as session cookies of higher privileged users who view the affected content. This can lead to unauthorized data disclosure and potential privilege escalation.
Dell Virtual Storage Integrator for VMware vSphere Client versions prior to 10.11.1.0 contain a critical vulnerability that allows unauthenticated remote attackers to disclose sensitive information. Exploitation can lead to session hijacking, enabling attackers to impersonate authenticated users, including administrators. Dell recommends upgrading to version 10.11.1.0 or later to address this issue.
CVE-2025-13909 is a medium severity vulnerability in WSO2 Identity Server versions 7.0.0 and 7.1.0. It involves insufficient validation of authentication requests using Email OTP, SMS OTP, or Magic Link, which fails to enforce tenant isolation. This flaw can lead to unauthorized exposure of personally identifiable information (PII) across tenants, including sensitive user details such as mobile numbers. No official patch or remediation level has been confirmed yet.
A vulnerability in the Gutenberg Essential Blocks WordPress plugin before version 6.4.0 allows unauthenticated users to read published entries of custom post types that are registered as non-public. This occurs because the plugin does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes. The vulnerability is classified as CWE-200 (Information Exposure) and has a high severity rating with a CVSS score of 7.5.
CVE-2026-13153 is an information exposure vulnerability in the Gutenberg Essential Blocks WordPress plugin before version 6.4.0. The plugin does not restrict access to a public REST route, which causes it to expose a non-public WooCommerce per-product sales metric. This allows unauthenticated users to read the lifetime number of units sold for any published product.
The Events Manager WordPress plugin before version 7.4 has a vulnerability where it does not perform authorization checks on a REST route that serves temporarily stored file uploads. This flaw allows unauthenticated users to access another user's in-progress upload if they know the temporary high-entropy identifier. However, the identifier is only disclosed to the uploader, and files are removed upon submission or scheduled cleanup, limiting the risk of unauthorized access by guessing alone.
CVE-2026-16954 is an information exposure vulnerability in the AI Engine WordPress plugin versions before 3.6.4. It allows users with the Editor role to access secret configuration values, such as third-party API keys and authentication tokens, in cleartext via an admin page's inline script data. These secrets are normally restricted to administrators. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
CVE-2026-14240 is a medium severity information exposure vulnerability in the tourmaster WordPress plugin before version 5.4.9. The plugin writes order and booking export files to a fixed, predictable location within a publicly accessible directory without access controls. This allows unauthenticated users to download exported customer personal information after an administrator performs an export.