CWE-200: Information Exposure vulnerabilities

CVE-2026-15048 is a high severity information exposure vulnerability in the Geeky Bot WordPress plugin before version 1.2.8. The plugin fails to perform authorization checks on one of its AJAX actions, allowing unauthenticated users to access chat-history session metadata. This metadata includes sensitive details such as WordPress usernames, user IDs, and timestamps.

A vulnerability in the JS Help Desk WordPress plugin before version 3.1.4 allows users with Contributor-level permissions to enumerate the email addresses of all registered WordPress users. This occurs because the plugin grants support-agent capabilities to Contributors on activation and fails to check user capabilities properly in a user-listing handler.

CVE-2026-14928 is an information exposure vulnerability in the JS Help Desk WordPress plugin before version 3.1.4. The plugin fails to perform authorization or ownership checks in a nonce-gated search handler, allowing any authenticated user with Subscriber or higher privileges to access the subject and full message body of all other users' support tickets.

GiveWP WordPress plugin versions before 4.16.3 have an information exposure vulnerability due to improper access restrictions on a REST API endpoint. This flaw allows unauthenticated users to access recurring donation records, including anonymous donors' names and subscription details. The vulnerability is identified as CWE-200 and has a high severity rating with a CVSS score of 7.5.

OpenProject versions prior to 17.6.0 have a vulnerability where certain API endpoints expose private work package titles and IDs to users who have permission to view time or cost entries but not the work packages themselves. This occurs because the API renders work package links without verifying if the user has visibility permissions. The issue is fixed in version 17.6.0.

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an attacker with access to the logs to potentially obtain senstive values related to that step.

When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process's in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option.

CVE-2026-14231 is an information exposure vulnerability in the LifterLMS WordPress plugin versions before 10.0.10. The plugin fails to perform proper capability checks in one of its AJAX handlers, allowing any authenticated user with subscriber-level access to read titles of internal post types such as coupon codes. This issue arises because the handler only verifies that the user is logged in, not their permissions.

MotoPress Hotel Booking WordPress plugin versions prior to 6.0.4 contain an information exposure vulnerability. The plugin fails to verify user capabilities before disclosing full customer booking details via an AJAX action. This allows any authenticated user with low privileges (Subscriber and above) to access personal data such as name, email, phone number, and address of other customers.

The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.

Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

Inappropriate implementation in IME in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

Inappropriate implementation in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

CVE-2026-67436 is a high-severity vulnerability in Linuxfabrik monitoring-plugins version 6.0.0 and earlier. The redfish-* plugins construct request URLs by concatenating an operator-supplied base URL with response-supplied @odata.id links. This improper input validation allows a malicious or compromised Baseboard Management Controller (BMC) to redirect authenticated Redfish requests, potentially exposing X-Auth-Token or HTTP Basic credentials.