The Magic Export & Import WordPress plugin before 1.2.0 stores exported CSV files at a publicly accessible location, making it possible for any visitors to leak sensitive user information.
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.1 via the '/dokan/v1/stores/{id}/reviews' REST API endpoint. This is due to the 'prepare_reviews_for_response' method including reviewer email addresses, usernames, and user IDs in the API response. This makes it possible for unauthenticated attackers to extract email addresses, usernames, and user IDs of all customers who left reviews on any vendor's store. The Pro version of the plugin must be installed and activated, with store reviews enabled, in order to exploit the vulnerability.
The Widgets for Social Photo Feed plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the '/trustindex_feed_hook_instagram/troubleshooting' and '/trustindex_feed_hook_instagram/submit-data' REST API endpoints in all versions up to, and including, 1.8. This makes it possible for unauthenticated attackers to access and update plugin settings.
Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability in MeWare Software Development Inc. PDKS allows Excavation.
This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.
CVE-2026-7381 is a critical vulnerability in Plack::Middleware::XSendfile for Perl that allows client-controlled path rewriting via the X-Sendfile-Type header. A malicious client can exploit this by setting the header to "X-Accel-Redirect" and manipulating the X-Accel-Mapping to access arbitrary files on the server behind nginx reverse proxies. This vulnerability exposes sensitive information to unauthorized actors. Plack::Middleware::XSendfile has been deprecated since version 1.0053 and will be removed in future releases. There is no official patch or remediation currently available.
CVE-2026-7041 is an information disclosure vulnerability in 666ghj MiroFish versions up to 0.1.2. It affects an unknown function in the Werkzeug Debugger PIN Handler component, specifically in the /console file. The vulnerability can be triggered remotely by manipulating the SECRET argument. Exploitation is considered difficult due to high attack complexity. Although the exploit is publicly available, there is no vendor response or patch at this time. The CVSS 4.0 base score is 6.3, indicating medium severity.
A weakness has been identified in SmythOS sre up to 0.0.15. This impacts an unknown function of the file packages/sdk/src/LLM/utils.ts of the component Connector Service. This manipulation of the argument baseURL causes information disclosure. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Dgraph versions prior to 25.3.3 expose sensitive information via an unauthenticated /debug/vars endpoint on the Alpha component. This exposure includes the process command line, which often contains the admin token passed as a startup flag. An attacker can retrieve this token and use it to access admin-only endpoints by replaying it in the X-Dgraph-AuthToken header. This vulnerability is a variant of a previously fixed issue but was incompletely remediated. The vulnerability is fixed in version 25.3.3.
CVE-2026-41079 is a medium severity vulnerability in OpenPrinting CUPS versions prior to 2.4.17. It involves an out-of-bounds read triggered by a crafted SNMP response sent to the CUPS SNMP backend. This flaw allows reading up to 176 bytes beyond a stack buffer, leaking memory that is converted to UTF-8 and exposed as printer supply descriptions. These leaked strings can be viewed by authenticated users through IPP Get-Printer-Attributes responses and the CUPS web interface. The vulnerability does not impact integrity or availability and requires network adjacency but no privileges or user interaction. A fix is available in version 2.4.17.
CVE-2026-41278 is a high-severity vulnerability in FlowiseAI's Flowise product versions prior to 3.1.0. The GET /api/v1/public-chatflows/:id endpoint returns the full chatflow object without sanitization, exposing sensitive information such as credential IDs, plaintext API keys, and password-type fields. The issue is exacerbated in the released v3.0.13 Docker image, which lacks the sanitization function entirely, leading to raw sensitive data exposure. This vulnerability is fixed in version 3.1.0.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive data including API keys, HTTP authorization headers and internal configuration without any authentication. An attacker with knowledge just of a chatflow UUID can retrieve credentials stored in password type fields and HTTP headers, leading to credential theft and more. This vulnerability is fixed in 3.1.0.
CVE-2026-4106 is a medium severity information exposure vulnerability in the HT Mega Addons for Elementor WordPress plugin prior to version 3.0.7. It allows unauthenticated attackers to access an AJAX action that returns personally identifiable information (PII) such as full name, city, state, and country of customers who placed orders in the last 7 days. This exposure does not affect integrity or availability but compromises confidentiality of customer data. No official patch or remediation guidance is currently confirmed. Users should monitor vendor advisories for updates and consider restricting access to affected plugin features until a fix is available.
CVE-2026-41182 is a vulnerability in the langchain-ai langsmith-sdk JavaScript and Python SDKs prior to versions 0.5.19 and 0.7.31 respectively. The issue arises because output redaction controls do not apply to streaming token events, allowing raw token values from streaming LLM outputs to be recorded and stored without redaction. This results in unintended exposure of sensitive information through run event data. The vulnerability has a CVSS score of 5.3, indicating medium severity. Fixed versions are available that address this issue by properly applying redaction to streaming events.
CVE-2026-4126 is a vulnerability in the primisdigital Table Manager WordPress plugin up to version 1.0.0 that allows authenticated users with Contributor-level access or higher to expose sensitive information from arbitrary WordPress database tables. The vulnerability arises because the shortcode handler for 'table_manager' accepts a user-controlled table name, sanitizes it insufficiently, and queries the database without verifying that the table belongs to the plugin. This can lead to unauthorized data disclosure through the frontend. The CVSS score is 4.3, indicating medium severity. No official patch or remediation guidance is currently available from the vendor.
The follow-redirects npm package prior to version 1.16.0 improperly forwards custom authentication headers such as X-API-Key or X-Auth-Token during cross-domain HTTP redirects. This behavior can lead to unintended disclosure of sensitive authentication information to untrusted redirect targets. The issue is fixed in version 1.16.0.
WWBN AVideo versions 29.0 and earlier contain a vulnerability where the file git.json.php executes a git log command and returns its output as JSON to any unauthenticated user. This behavior exposes sensitive information including the exact deployed commit hash, developer names and email addresses, and commit messages. Such exposure can enable version fingerprinting and reveal personally identifiable information (PII) and potentially sensitive internal references. No patched versions are currently available for this vulnerability. The CVSS score is 5.3, indicating a medium severity level.
goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including Authorization. An unauthenticated observer can capture a victim's folder-specific basic-auth header and replay it to read, upload, overwrite, and delete files inside the protected subtree. This vulnerability is fixed in 2.0.0-beta.6.
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view and folder queries, but not to non-folder query builders. Global search and the AJAX filter path still reveal conversations that should be hidden. Version 1.8.215 fixes the vulnerability.
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can access diagnostic and system tools that should be restricted to administrators. The /system/cron endpoint relies on a static MD5 hash derived from the APP_KEY, which is exposed in the response and logs. Accessing these endpoints reveals sensitive server information (Full Path Disclosure), process IDs, and allows for Resource Exhaustion (DoS) by triggering heavy background tasks repeatedly without any rate limiting. The cron hash is generated using md5(APP_KEY . 'web_cron_hash'). Since this hash is often transmitted via GET requests, it is susceptible to exposure in server logs, browser history, and proxy logs. Furthermore, the lack of rate limiting on these endpoints allows for automated resource exhaustion (DoS) and brute-force attempts. Version 1.8.213 fixes the issue.