Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing. Second, `Customers/Create::store()` re-passed a `Hidden` `_password` form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads. Finally, the product barcode field was rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`. An attacker with `edit_products` permission could persist malicious payload in the barcode field that would execute in the browser of any admin user viewing that product, enabling session theft and privileged-action chaining. Starting in v2.8.0, all vulnerable Livewire model identifiers are now marked `#[Locked]`; `Customers/Create` no longer round-trips the password through a Hidden form field; the plaintext password is hashed at action boundary and never returned to the client; and the product barcode rendering now escapes the value before passing it to the barcode generator and the output is wrapped in an `<svg>` context that does not interpret event handlers. No known workarounds are available.
Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.
The Convert Forms extension for Joomla versions 2.5.0 through 5.2.2 contains an improper access control vulnerability in its front-end Submissions view. This flaw allows unauthenticated visitors to list form submissions, leading to sensitive data exposure. The vulnerability is identified as CWE-284 (Improper Access Control) and CWE-200 (Information Exposure). It has a high severity rating with a CVSS score of 8.2. No official patch or remediation guidance is currently available from the vendor.
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the REST API. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
Gitea contains a vulnerability in its API path for changing repository visibility from public to private. When this change is made via the REST API, stale watch records are not cleared, allowing users who lost access to still see metadata of the now-private repository in their subscription list. This leads to exposure of repository metadata and inflated watcher counts. The issue affects versions from v1.25.4 up to but not including v1.27.0. The severity is medium with limited confidentiality impact and no integrity or availability impact.
Gitea versions prior to 1.27.0 contain a vulnerability in the organization-level Actions API that allows any member of the organization to enumerate workflow runs and jobs across all repositories within that organization. This includes private repositories and repositories where the user lacks explicit permissions. The issue is due to missing repository-level access control checks in the API endpoints, which rely solely on organization membership for authorization.
Gitea versions prior to 1.27.0 have a vulnerability where webhook authorization headers, although stored encrypted in the database, are decrypted and returned in plaintext through certain API endpoints. This exposure allows repository or site administrators to view sensitive authorization headers such as Bearer tokens, Basic authentication credentials, and API keys set by other admins. The vulnerability affects multiple API endpoints that return webhook details and compromises the intended encryption-at-rest protection by revealing secrets in API responses.
Gitea Notification API in versions prior to 1.26.4 leaks private issue and pull request metadata through the 'subject' field of notification threads after a user's access to a private repository has been revoked. While the 'repository' field is correctly nulled, the 'subject' field still exposes sensitive information such as issue titles, URLs, state, and comment activity. This allows users who lost access to continue observing ongoing activity on private issues or pull requests via notifications.
libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue.
HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security.
HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions.
PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands `@url:` mentions in raw prompt text before agent execution begins. If a prompt contains `@url:<http-or-https-url>`, the CLI calls `MentionsParser.process(...)`. The `@url:` handler then performs a direct `urllib.request.urlopen()` request to the attacker-controlled URL and returns the response body. That response body is prepended to the final model prompt context. There is no loopback/private-address restriction, no metadata-service restriction, and no approval gate before the fetch. As a result, attacker-influenced prompt text can cause the operator's machine to fetch localhost-only HTTP resources and inject the response into model context. PraisonAI version 4.6.40 and praisonaiagents version 1.6.40 contain a fix.
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in `mcp_server/adapters/cli_tools.py`. Commit `68cc9427` ("fix(security): harden MCP rules path handling…") added a `_resolve_rule_path()` helper and applied it to `rules.create`, `rules.show`, and `rules.delete`. `workflow.show` was left unchanged. Two adjacent handlers in the same file have the same pattern, `workflow.validate` and `deploy.validate`. Neither was mentioned in the original advisory. Both remained unchanged. The original advisory also identified the dispatcher (`server.py:281-298`) as a root cause. It accepts unvalidated `**kwargs` from `params["arguments"]` with no enforcement against the tool's declared `input_schema`. That code is unchanged prior to version 4.6.40. A single unauthenticated MCP `tools/call` to `praisonai.workflow.show` returns the contents of any file the host user can read: `/etc/passwd`, `~/.ssh/id_rsa`, `~/.aws/credentials`, or any project `.env`. Version 4.6.40 contains an updated fix.
CVE-2026-16405 is an information disclosure vulnerability in the Networking: WebSockets component of Mozilla Firefox and Thunderbird. This flaw could allow unauthorized access to sensitive information through the WebSockets feature. The issue was resolved in Firefox version 153 and Thunderbird version 140.13. No known exploits are reported in the wild. The vulnerability is rated with high impact due to the nature of information disclosure.
CVE-2026-16400 is an information disclosure vulnerability in the DOM security component of Firefox and Thunderbird. This vulnerability allows unauthorized disclosure of information due to a flaw in the Document Object Model security handling. The issue was fixed in Firefox 153 and Thunderbird 153. No known exploits are reported in the wild. The severity of this vulnerability is high.
CVE-2026-16391 is an information disclosure vulnerability in the Storage: IndexedDB component of Mozilla Firefox and Thunderbird. The issue was resolved in Firefox 153 and Firefox ESR 140.13, as well as Thunderbird 153 and Thunderbird 140.13. This vulnerability could allow unauthorized access to certain information stored in IndexedDB. No known exploits are reported in the wild.
CVE-2026-16374 is an information disclosure vulnerability in the Framework component of DevTools. It was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. The vulnerability could allow unauthorized access to sensitive information through the affected component. No known exploits in the wild have been reported.