CWE-201 vulnerabilities

Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless of the entitlements owned by the caller. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2. Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.

CVE-2026-89332 is a vulnerability in AWS Kiro IDE versions before 0.8.135 where the Kiro Powers feature includes functionality from an untrusted control sphere. This flaw allows remote unauthenticated actors to cause the IDE agent to modify workspace settings, redirecting registry requests to attacker-controlled endpoints and leaking workspace data. The issue is fixed in version 0.8.135. Users who opened projects with earlier versions should rotate any credentials present in those projects.

Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4.

Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore &amp; Migration <= 2.4.2 versions.

CVE-2026-78374 is a medium severity vulnerability in the T4 Page Builder extension for Joomla by joomlart.com. Versions 1.0.0 through 2.2.0 are affected. The vulnerability allows unauthenticated attackers to send emails via an open mail relay through the front-end JSON editor's contact AJAX endpoint. This endpoint lacks authentication, CSRF protection, captcha enforcement (if no captcha plugin is enabled), and rate limiting. Attackers can fully control the recipient, subject, and HTML body of the email, which is sent from the site's configured sender identity.

A vulnerability in the SP Property extension for Joomla versions 1.0.0 through 4.1.3 allows unvalidated email destination and form manipulation in booking requests. This occurs because booking inquiries rely on client-submitted hidden fields for recipient routing, which can be manipulated to insert sensitive information into sent data. The issue is tracked as CVE-2026-78303 with a medium severity rating and a CVSS score of 6.9.

CVE-2026-65812 is a vulnerability in Microsoft Teams for Android where sensitive information can be inserted into sent data, potentially allowing an authorized attacker to disclose this information over a network. The issue affects versions from 1.0.0 up to but not including 1.0.0.2026133602. A fix is available in version 1.0.0.2026133602. The vulnerability has a CVSS score of 6.8, indicating a medium severity level.

CVE-2026-86505 is a low-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.2.2 where a missing project-trust check caused leakage of project metadata to JetBrains Marketplace. This issue does not allow unauthorized modification or denial of service but may expose some project information. The vulnerability has a CVSS score of 3.3 and requires user interaction with low privileges. No known exploits are reported in the wild. A fix is implied by the versioning but no explicit patch link is provided.

CVE-2026-86497 is a vulnerability in JetBrains YouTrack before version 2026.2.18769. It allows a project administrator to exfiltrate stored mailbox credentials by changing a mailbox host without re-authentication. The vulnerability has a medium severity with a CVSS score of 6.8.

Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08.

Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. This issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x, and is fixed in version 3.96.0.

Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1.

Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions.

A vulnerability in the node-modules urllib HTTP client for Node.js allows sensitive authorization headers and tokens to be sent to attacker-controlled redirected origins due to improper reuse of request options across different origins during redirects. This can expose credentials such as Authorization, Cookie, Proxy-Authorization, and various API tokens without user interaction. The issue affects versions prior to 2.44.1 and 4.9.1 and has a high severity rating.

CVE-2026-66585 is a high-severity vulnerability in WP Cafe Pro versions prior to 3.0.15 that allows unauthenticated attackers to cause sensitive data exposure. The flaw is categorized under CWE-201, which involves insertion of sensitive information into sent data. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-63481 is a vulnerability in Orange-OpenSource hurl versions up to 8.0.1 where redirect handling improperly carries cookies from the dedicated [Cookies] section into redirected requests across hosts. This can expose authentication or session cookies to attacker-controlled redirects. The issue is fixed in version 8.1.0.

A vulnerability in the cmsjunkie.com J-BusinessDirectory extension for Joomla versions 1.0.0 through 6.2.2 allows an attacker to send emails to arbitrary addresses. The recipient address is taken from user-controlled request parameters instead of server-side records, resulting in an open mail relay issue.

CVE-2026-73386 is a high-severity vulnerability in the ZealousWeb Track Geolocation Of Users Using Contact Form 7 plugin, affecting versions up to 3.0.2. It allows unauthenticated attackers to expose sensitive data by inserting it into sent data. The vulnerability is classified under CWE-201, indicating insertion of sensitive information into sent data. There is no explicit patch or remediation information provided.