ApostropheCMS versions prior to 4.33.0 have a vulnerability where an unauthenticated user can access the GET /api/v1/<piece-type>/:_id/locales REST route without proper authorization checks. This allows the user to determine if a document exists and which locales it is published in, exposing sensitive metadata that should be restricted. The issue is fixed in version 4.33.0.
ApostropheCMS versions from 1.25.0 up to but not including 1.28.0, when configured with the Azure backend and SAS tokens enabled, leak account-level SAS tokens in public attachment URLs. This exposure occurs because the BlobServiceClient is constructed from a URL embedding the full SAS query string, which is then inherited by Azure SDK clients. The issue is fixed in version 1.28.0 and later.
ApostropheCMS versions prior to 4.34.0 have a vulnerability where a public REST API using publicApiProjection can allow inference of excluded searchable or sortable field information. Although the returned fields are filtered by the projection, this flaw permits targeted inference about hidden values rather than a full data leak. The issue is resolved in version 4.34.0.
ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires or is removed. A user with export permission must first create the archive, and sites with exports disabled, private upload storage, or authenticated upload delivery are not exposed through this network-download path. This issue is fixed in version 3.7.1.
A vulnerability in apostrophecms apostrophe before version 4.34.0 allows any authenticated user to enumerate all slugs in the CMS, including private, draft, and archived content, via the slugTaken API endpoint. This endpoint does not enforce permission checks or filter by document visibility or publication status, leading to unauthorized exposure of sensitive information.
Vitest is a testing framework powered by Vite. From 5.0.0-beta.6 until 5.0.5, Vitest dev servers can misapply server.fs.deny because project servers replace Vite's defaults and the root server adds .vitest-secret-token after Vite compiles its matcher. An attacker who can reach an affected UI, Browser Mode, or API server can read denied project files or the fallback API token at node_modules/.vitest/.vitest-secret-token, and Browser Mode with test.projects can expose JavaScript-compatible .env values through a malicious website. This issue is fixed in version 5.0.5.
CVE-2026-112947 is a path traversal vulnerability in the Vite development server that allows an attacker to retrieve the first 4 bytes of arbitrary files on disk by sending a request with the query parameter '?vite-wasm-instance'. This occurs because the internal Wasm plugin's load hook reads files without applying server.fs access restrictions. The vulnerability affects Vite versions >=0.2.8 <1.1.0, >=8.2.0 <8.2.4, and >=8.3.0 <8.3.3. It only impacts applications that expose the Vite dev server to the network, run on Node.js or Deno, and have sensitive information in the first 4 bytes of a file. The issue is fixed in versions 1.1.0, 8.2.4, and 8.3.3.
The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private activity notes.
The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public REST API output, allowing unauthenticated users to read details a site has chosen to hide on published listings, such as the asking price, sold price, street address and exact map coordinates.
A vulnerability in follow-redirects versions 1.16.0 to before 1.16.1 allows sensitive headers with certain metacharacters to be forwarded to attacker-controlled redirect targets due to incorrect regular expression escaping. This flaw is fixed in version 1.16.1.
CVE-2026-107187 is a high-severity vulnerability in Eptura Archibus that allows unauthorized exposure of sensitive database information. An attacker can send a DWR request with a crafted workflow rule to access database details such as usernames and passwords. This vulnerability can be combined with an authentication bypass to read database contents without authentication. Although database write and delete operations might be possible, these actions have not been tested. The issue affects versions prior to 2025.02 and has been fixed in version 2025.02.
CVE-2026-111056 is an information exposure vulnerability in FOSSBilling versions from 0.1.0 up to but not including 0.8.7. The unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email address belongs to an existing registered client by returning a distinct unredacted error message. This allows an attacker to enumerate registered client emails. The issue is fixed in version 0.8.7.
CVE-2026-111053 is a path traversal vulnerability in FOSSBilling versions 0.1.0 through 0.8.6. The unauthenticated api/guest/system/template_exists endpoint improperly handles the file parameter, allowing attackers to submit traversal sequences to check for the existence of arbitrary files or directories on the server. This vulnerability does not disclose file contents. It is fixed in version 0.8.7.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than by the route, once followRedirects=true. OAuth2ClientConfigurer registers its interceptor with addRequestInterceptorFirst, and HttpClient runs protocol-level request interceptors inside ProtocolExec, which sits below RedirectExec in the exec chain; the interceptor therefore ran again for every redirect hop and re-attached Authorization: Bearer to whatever host the Location header named. Separately, credentials were registered against an AuthScope matching any host, so basic and digest credentials were presented to a redirect target as well. A remote endpoint - or anyone who can influence its responses - could therefore collect the bearer token or the configured credentials simply by answering with a redirect to a host it controls.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. Credentials are now sent only to the authority the endpoint was configured with, and are not re-attached when a redirect crosses to another host. For deployments that cannot upgrade immediately, set followRedirects=false on endpoints that carry credentials, and handle any redirect explicitly in the route so that the destination is chosen by the route rather than by the remote server.
CVE-2026-78164 is a high-severity vulnerability in Apache Camel HTTP, Netty HTTP, Undertow, and Vert.x HTTP components. It involves improper neutralization of special elements used in a template engine, allowing inbound messages to override endpoint URIs via headers that are processed through a property-placeholder resolution mechanism. This can lead to exposure of sensitive information and unintended configuration or bean method invocation. The issue affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. Fixed versions are 4.18.5 and 4.22.1, with 4.23.0 recommended for the latest fixes. Mitigations include upgrading to fixed versions or stripping override headers at the trust boundary, or setting skipControlHeaders=true on camel-http endpoints. The vulnerability is not mitigated by bridgeEndpoint=true or percent-encoding placeholder delimiters.
CVE-2026-78163 is a Server-Side Request Forgery (SSRF) vulnerability in the Apache Camel Docling component affecting versions from 4.15.0 before 4.18.5 and from 4.19.0 before 4.22.1. The vulnerability arises because the DoclingProducer interprets message body prefixes to decide how to process them, allowing untrusted input to trigger remote URL fetches or local file reads without explicit configuration. This implicit mode selection can lead to unauthorized access to remote or local resources. The issue is fixed in Apache Camel versions 4.18.5 and 4.22.1. Users unable to upgrade immediately should avoid routing external message bodies into Docling endpoints or use typed bodies or headers to prevent prefix interpretation.
CVE-2026-76994 is a vulnerability in Apache Answer versions up to 2.0.2 that allows unauthenticated attackers to access metadata associated with hidden questions via public answer profiles. This exposure of sensitive information can occur without any authentication or user interaction. The issue is fixed in version 2.0.3.
MISP versions prior to 2.5.48 have a vulnerability in the handling of module plugin settings where sensitive flags such as redacted and cli_only are dropped during server processing. This causes sensitive information like API keys to be exposed to any authenticated user with access to server settings, and allows modification of settings intended to be restricted to CLI-only access.
MISP versions prior to 2.5.48 contain a vulnerability in the server settings lookup mechanism that allows authenticated users to retrieve sensitive configuration data that should have been redacted. This occurs because branch nodes in the configuration tree do not carry redaction flags, enabling full branch contents—including security salts, Redis passwords, and plugin API keys—to be exposed. The vulnerability affects endpoints that retrieve and edit server settings, leading to unauthorized disclosure of sensitive server secrets.