CWE-201 vulnerabilities

CVE-2026-73384 is a high-severity vulnerability in the cmsMinds Pay with Contact Form 7 plugin, versions up to and including 1.0.4. It involves unauthenticated sensitive data exposure due to insertion of sensitive information into sent data. The vulnerability allows an attacker with network access to obtain sensitive information without authentication. There is no information on available patches or vendor advisories at this time.

CVE-2026-74008 is a medium severity vulnerability in the Averta LTD Shortcodes and extra features for Phlox theme (auxin-elements) that allows insertion of sensitive information into sent data. This vulnerability affects versions from 0 up to and including 2.17.24. It enables retrieval of embedded sensitive data without requiring privileges or user interaction.

Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.

Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.

Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.

CVE-2026-16637 is a server-side request forgery (SSRF) vulnerability in OPeNDAP Inc.'s hyrax-docker version 1.18.0. It allows attackers to bypass the AllowedHosts allowlist via unvalidated HTTP redirects, leading to leakage of Earthdata headers including User-Id and Echo-Token to attacker-controlled endpoints. This vulnerability can expose sensitive credential information but does not impact data integrity or availability.

CVE-2026-66696 is a medium severity vulnerability in Gutenberg Blocks by Kadence Blocks versions up to and including 3.7.8. It involves the insertion of sensitive information into sent data, classified under CWE-201. The vulnerability allows exposure of contributor sensitive data without requiring user interaction and with low attack complexity. No official patch or remediation guidance is currently available.

CVE-2026-66685 is a medium severity vulnerability in Alex Featured Video Plus versions up to 2.3.3 that allows unauthenticated sensitive data exposure. The flaw involves insertion of sensitive information into sent data, classified under CWE-201. There is no official patch or remediation guidance currently available from the vendor. No known exploits are reported in the wild.

Unauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.

CVE-2026-66683 is a medium severity vulnerability in WP Zone's Custom CSS and JavaScript plugin versions up to and including 2.0.16. It involves unauthenticated sensitive data exposure due to insertion of sensitive information into sent data. The vulnerability does not require user interaction or privileges to exploit and impacts confidentiality but not integrity or availability.

CVE-2026-65543 is a high-severity vulnerability in Vimeo versions up to and including 1.2.2 that involves the insertion of sensitive subscriber data into sent data, leading to potential exposure of sensitive information. The vulnerability is classified under CWE-201. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-66901 is a server-side request forgery (SSRF) vulnerability in Google::Auth for Perl versions before 0.09. The vulnerability arises because the library does not validate URLs read from the credentials JSON, allowing attackers to cause the application to make unauthorized requests to internal or external hosts. This can lead to credential exfiltration. The issue was progressively mitigated in versions 0.06 through 0.09 by adding URL validation and host checks.

CVE-2026-20484 is a medium severity vulnerability in MediaTek chipsets that involves possible local information disclosure due to a missing permission check in the TFA component. Exploitation requires the attacker to already have System privileges, and no user interaction is needed. The vulnerability could allow disclosure of sensitive information but does not affect integrity or availability.

CVE-2026-28144 is a vulnerability in the WP Maps plugin by Flipper Code that allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. It affects all versions up to and including 4.9.6. The vulnerability has a medium severity with a CVSS score of 4.3. No official patch or remediation guidance is currently available from the vendor.

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_API_KEY from the environment and sends them in the Authorization: Bearer header to caller-controlled base_url, allowing an attacker to receive the operator's key on a public host that passes the SSRF guard. This issue is fixed in version 2.26.6.

A vulnerability in swagger-typescript-api prior to version 13.12.2 allows exposure of sensitive bearer tokens. The issue occurs because the authorization token is forwarded to every URL fetched when resolving external references in OpenAPI specifications. This can lead to an attacker-controlled OpenAPI spec exfiltrating the developer or CI bearer token to a cross-origin endpoint. The vulnerability is fixed in version 13.12.2.

Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10 have a vulnerability where Server Action IDs can be disclosed to unauthenticated users via publicly served client artifacts. This affects applications using App Router and Server Actions, allowing information disclosure that bypasses authentication on affected pages. The issue is fixed in versions 15.5.21 and 16.2.11.