CWE-200: Information Exposure vulnerabilities

A vulnerability in the WP Post Author WordPress plugin before version 4.2.0 allows unauthenticated users to access integration settings, including the reCAPTCHA secret key if saved. This exposure of sensitive information could potentially aid attackers in bypassing security controls relying on reCAPTCHA.

A vulnerability in the Link Library WordPress plugin before version 7.10.0 allows unauthenticated users to access sensitive information such as telephone numbers, email addresses, and submitter names associated with links. This occurs because the plugin does not verify that a requested link belongs to the settings set whose display template is used to render it, potentially exposing data configured to be hidden.

CVE-2026-115282 is a vulnerability in the Recipe Card Blocks Lite WordPress plugin versions from 2.6.4 up to but not including 3.6.4. The plugin fails to perform proper authorization checks before rendering posts via its recipe print feature. This flaw allows unauthenticated users to access the title, ID, and recipe content of unpublished posts, including drafts, pending, private, and password-protected posts containing a recipe card block. The optional protection to print only published posts is ineffective because the status check is applied to a different post than the one rendered. A fix is available in version 3.6.4.

CVE-2026-40063 is an information disclosure vulnerability in the /nodered/fuxa/scripts functionality of Frangoteam's FUXA product version 1.3.2-2809. An unauthenticated attacker can send a specially crafted HTTP request to trigger this flaw and leak sensitive information. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-118666 is a vulnerability in the ardatan graphql-tools legacy WebSocket executor package prior to version 1.1.36. The issue arises because the executor reuses a single WebSocket and replaces its onmessage handler for new overlapping subscriptions without verifying the subscription operation ID. This allows unauthorized access to another user's subscription payload. The flaw is fixed in version 1.1.36.

FearlessCMS versions prior to 0.1.4 contain multiple unauthenticated debug/test PHP scripts under the admin directory that allow privileged operations without authentication or CSRF protection. These scripts enable attackers to bypass admin login via crafted URIs, perform arbitrary file writes and reads including path traversal, execute stored cross-site scripting, enumerate directories, and cause disk exhaustion. The vulnerability allows site defacement, session theft, and potential full system compromise when PHP runs with elevated privileges. The issue is fixed in version 0.1.4.

GeoDirectory WordPress plugin versions before 2.8.195 allow users with Contributor role or higher to access content and custom fields of other users' draft, pending, private, and trashed listings. This occurs because the plugin does not check listing status or ownership when rendering listings referenced by an id attribute in its field shortcodes. The issue is fixed in version 2.8.195.

CVE-2026-110509 is a vulnerability in the Essential Addons for Elementor WordPress plugin before version 6.8.7. It allows unauthenticated visitors to access the pagination endpoint without proper restrictions on post type or meta queries. This flaw can lead to unauthorized reading of non-public post content and exposure of private custom field values on published posts. The issue is fixed in version 6.8.7.

A vulnerability in the Page Builder by SiteOrigin WordPress plugin before version 2.38.0 allows users with contributor role and above to access content of other users' draft, pending, scheduled, and private posts and pages. This occurs because the plugin does not restrict query arguments in its Post Loop widget or limit access to posts users are authorized to read.

A vulnerability in PayPlug for WooCommerce (Official) versions 2.9.0 up to but not including 3.1.1 allows unauthenticated users to access another customer's order key and cancel their unpaid guest order. This occurs because the plugin does not verify ownership of the WooCommerce order in payment requests. The issue is fixed in version 3.1.1.

CVE-2026-107100 is a vulnerability in the Royal Addons for Elementor WordPress plugin versions 1.3.81 up to but not including 1.7.1070. It allows unauthenticated users to access content of posts stored in non-public post types via an AJAX action that does not properly verify post visibility. This can lead to exposure of sensitive information such as contact form submissions containing names, email addresses, and messages.

CVE-2026-103372 is a vulnerability in the Payconiq WordPress plugin up to version 1.0.4 that allows unauthenticated users to access order confirmation links without verifying authorization. This flaw enables attackers to retrieve any paid order's key and, for recent guest orders, view customers' personal information.

MLflow versions from 2.19.0 up to but not including 3.17.0 contain a vulnerability where the mlflow.crewai.autolog() function records CrewAI Agent objects without properly sanitizing nested credential data. This results in plaintext provider API keys being included in trace data sent to the MLflow trace backend or OTLP destinations, exposing sensitive credentials to unauthorized readers. The issue is resolved in version 3.17.0.

CVE-2026-116685 is a vulnerability in the Model Context Protocol Python SDK affecting versions from 1.8.0 up to but not including 1.30.0 and from 2.0.0 up to but not including 2.2.0. Certain client components improperly follow HTTP redirects to different origins while forwarding sensitive custom credential headers and request bodies for 307 or 308 responses. This behavior can expose sensitive information to unauthorized actors if an attacker can influence the redirect destination. The issue is fixed in versions 1.30.0 and 2.2.0.

A vulnerability in the Nextcloud Tables app allows users with read-data access to a table to enumerate all share recipients and their permission levels via a specific API endpoint. This exposure does not include the table's data itself but reveals sensitive sharing information that should be restricted to users with manage-level permissions.

CVE-2026-116575 is a vulnerability in mem0, a persistent memory infrastructure for AI agents. Before Python SDK 2.0.18 and TypeScript SDK 3.1.6, session scope keys were constructed by joining user-controlled identifiers with unescaped delimiters, allowing attackers to craft identifiers that cause cross-tenant session key collisions. This flaw enables unauthorized access to other tenants' conversation histories, leading to exposure and potential manipulation of sensitive information. The issue is fixed in versions 2.0.18 (Python) and 3.1.6 (TypeScript).

CVE-2026-82943 is an out-of-bounds read vulnerability in RT-Labs AB SOEM affecting versions before 2.0.1. A malicious device can send crafted messages causing the master to read memory beyond intended buffers, potentially exposing up to 64KB of sensitive data. The issue arises because the software does not validate length values from device responses against actual buffer sizes.

GiveWP WordPress plugin versions before 4.19.0.1 allow unauthenticated users to view unpublished donation forms, including draft, pending, private, and scheduled forms. This occurs because the plugin does not check user status or capabilities when rendering donation forms on public front-end routes, exposing sensitive form content and settings that WordPress core normally protects.

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers, allowing unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.

The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes, allowing unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.