CWE-497 vulnerabilities

CVE-2026-9307 is a medium severity vulnerability in Rockwell Automation CompactLogix 5370 controllers (version V36). The controller's web server exposes CIP Connection IDs on its diagnostics webpage, which are accessible without authentication. This exposure of sensitive system information can be leveraged by an attacker to craft malicious packets that may cause a denial-of-service condition.

Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.

Subscriber Sensitive Data Exposure in Coupon Affiliates <= 7.8.1 versions.

Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions.

Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions.

CVE-2026-48878 is a medium severity vulnerability in Bootstrapped Ventures Visual Link Preview versions up to and including 2.4.1. It involves exposure of subscriber sensitive data due to improper handling of system information. The vulnerability is classified under CWE-497, indicating exposure of sensitive system information to unauthorized entities. No official patch or remediation level has been provided yet by the vendor. The vulnerability has not been reported as exploited in the wild.

CVE-2026-42660 is a vulnerability in Wasiliy Strecker's Contest Gallery product that allows exposure of subscriber sensitive data to unauthorized parties. It affects versions up to and including 28.1.7. The vulnerability is classified under CWE-497, indicating exposure of sensitive system information to an unauthorized control sphere. The CVSS 3.1 base score is 6.5, reflecting a medium severity with high confidentiality impact but no integrity or availability impact. No official patch or remediation guidance is currently available from the vendor.

CVE-2026-40796 is a vulnerability in WPPizza versions up to and including 3.19.9 that results in exposure of subscriber sensitive data to unauthorized parties. The issue is classified under CWE-497, indicating exposure of sensitive system information to an unauthorized control sphere. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting a medium severity level. No official patch or remediation guidance is currently available from the vendor. The vulnerability does not require user interaction but requires low privileges to exploit and impacts confidentiality without affecting integrity or availability.

CVE-2026-34891 is a high-severity vulnerability in the IDPay Payment Gateway for Woocommerce affecting versions up to and including 2.2.5. It allows unauthenticated attackers to expose sensitive system information. The vulnerability is classified under CWE-497, indicating exposure of sensitive system information to an unauthorized control sphere. No official patch or remediation guidance is currently provided by the vendor.

CVE-2026-24618 is a medium severity vulnerability in HashThemes Hash Elements that allows unauthorized retrieval of embedded sensitive system information. The vulnerability is classified as CWE-497, indicating exposure of sensitive system information to an unauthorized control sphere. It affects versions up to 1.5.4. There is no confirmed patch or official remediation available at this time.

Improper access control in AMD uProf may allow a local attacker with user privileges to write to the kernel-shared memory section, potentially resulting in crash or denial of service.

CVE-2026-44743 is a vulnerability in SAP Business Objects where an unauthorized attacker can access a specific endpoint to leak sensitive system information. The impact is limited to confidentiality with no effect on integrity or availability. The vulnerability has a low severity rating and a CVSS score of 3.7. No official patch or remediation guidance has been provided yet. The affected versions explicitly include 2025 and 2027.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tips and Tricks HQ WP eMember allows Retrieve Embedded Sensitive Data. This issue affects WP eMember: from n/a through v10.2.2.

The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex patterns) and revealing underlying URI parsing logic. Leading to low impact on confidentiality. Integrity and availability are unaffected.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPFunnels Team Mail Mint allows Retrieve Embedded Sensitive Data. This issue affects Mail Mint: from n/a through 1.19.5.

An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings.

CVE-2026-0239 is an information disclosure vulnerability in Palo Alto Networks Chronosphere Chronocollector. It allows an unauthenticated attacker with network access to the collector service to retrieve sensitive information. The vulnerability is categorized under CWE-497, indicating exposure of sensitive system information to an unauthorized control sphere. The CVSS 4.0 base score is 4.9, reflecting a medium severity level. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.

SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the new GINA UI, allowing remote attackers to obtain sensitive system information.

A vulnerability in inngest-js versions 3.22.0 through 3.53.1 allows unauthenticated remote attackers to exfiltrate environment variables via the serve() HTTP handler when accessed with PATCH, OPTIONS, or DELETE requests. This exposure occurs because the diagnostic response to these methods includes the full contents of process.env, potentially leaking secrets, API keys, or credentials. Applications exposing the serve() endpoint to these HTTP methods are vulnerable, which is common in some frameworks like Next.js Pages Router or Express using app.use(...

CVE-2026-25468 is a medium severity vulnerability in the weDevs Happy Addons for Elementor plugin that allows unauthorized exposure of sensitive system information. The vulnerability affects versions up to 3.20.8 and enables retrieval of embedded sensitive data without requiring privileges or user interaction. There is no confirmed patch or official remediation available at this time. The vulnerability has not been reported as exploited in the wild.