CWE-200: Information Exposure vulnerabilities

CVE-2026-108823 is a vulnerability in Apache Kylin versions 4.0.0 through 5.0.4 that allows exposure of sensitive information to unauthorized actors during job manipulation. The impact is considered minor unless the job services are exposed to a public network, which is uncommon. The issue is fixed in version 5.0.5.

A logic error in MISP event synchronization caused non-exportable tags to be improperly filtered, leading to exposure of sensitive tag information to remote instances during event pushes. This affects MISP versions prior to 2.5.48 when pushing multiple reports in a synchronization. Additionally, pushing an empty last report could cause the remote instance to fail saving the event.

The FormFlow for GoHighLevel (GHL) WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the integration, a third-party access token.

CVE-2026-103091 is a critical vulnerability in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8. It involves missing authorization and insecure default initialization in the MCP proxy and OIDC registration flow, allowing remote attackers to self-enroll and gain full read, write, and execution access on backend services. The flaw arises because the GET /info endpoint publicly exposes OIDC configuration, and the POST /register endpoint auto-enrolls any valid OIDC token holder without claim filtering or ban checks. The default policy binds authenticated users to wildcard services and targets, enabling broad unauthorized access. The issue is fixed in version 0.1.0-alpha.9, which enforces stricter policy controls and ban checks.

A vulnerability in Gitea allowed authenticated users to access sensitive profile information of users with private profiles via POST requests. The visibility check was only enforced on GET requests, enabling exposure of full name, location, website, and description. This issue was fixed in version 28.1.0 and publicly disclosed in 28.2.0.

A vulnerability in Gitea allows users with permission to create draft releases to obtain metadata about attachments from repositories they cannot access. Specifically, creating a draft release via the API returns an assets list containing metadata of issue and comment attachments, including file name, UUID, upload time, size, and download count, even for repositories without read access and abandoned uploads.

A vulnerability in the Modern Events Calendar Lite WordPress plugin before version 7.37.0 allows any authenticated user, including those with minimal privileges such as Subscribers, to access sensitive event booking and attendee information. This includes names, email addresses, transaction IDs, and payment amounts. The issue arises because the plugin does not perform proper capability, nonce, or ownership checks before disclosing this data.

CVE-2026-97314 is a medium severity information exposure vulnerability in the ThirstyAffiliates WordPress plugin before version 3.12.1. The plugin's link redirect tracking handler does not verify the status or type of the requested object, allowing unauthenticated attackers to disclose destination URLs of unpublished affiliate links and to submit fabricated click statistics.

A vulnerability in the PeachPay — Payments & Express Checkout for WooCommerce WordPress plugin before version 1.120.70 allows unauthenticated users to retrieve the secret key of any paid order. This occurs because the plugin does not perform capability or ownership checks before returning the order's secret key. The exposed key can be used to view sensitive customer information including name, email, postal address, and order contents. The vulnerability has a medium severity with a CVSS score of 5.3.

The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.4 has a vulnerability that allows unauthenticated attackers to access sensitive customer information. This occurs via the 'params (customer[uuid])' parameter through the unauthenticated steps__load_step AJAX endpoint when the plugin is configured in guest checkout mode ('Field used for authentication' set to 'Disable ability to login'). The exposed data includes first name, last name, email address, phone number, and notes of all customer records.

Arcane versions prior to 2.5.0 contain a vulnerability where an attacker with certain registry permissions can cause the system to send a stored encrypted container registry token to an attacker-controlled host. This occurs because the registry URL can be changed without supplying a replacement token, leading to exposure of sensitive authentication credentials. The issue is fixed in version 2.5.0.

Apache Kylin versions 4.0.0 through 5.0.4 contain a vulnerability (CVE-2026-69080) that exposes the SQL Black List to unauthorized actors. This exposure can lead to sensitive information disclosure. The issue is resolved in Apache Kylin version 5.0.5.

CVE-2026-69077 is a vulnerability in Apache Kylin versions 4.0.0 through 5.0.4 that allows unauthorized exposure of sensitive information through cross-project job manipulation. The issue primarily affects Kylin services exposed directly to public networks, which is uncommon, and most in-house deployments are not impacted. The vulnerability has a high severity with a CVSS score of 7.5. Upgrading to Apache Kylin version 5.0.5 addresses this vulnerability.

CVE-2026-69076 is a vulnerability in Apache Kylin that allows unauthorized actors to access sensitive information related to job discard. This affects Apache Kylin versions from 4.0.0 through 5.0.4. The vulnerability primarily impacts Kylin services exposed directly to the public network, which is uncommon, while typical in-house deployments are mostly unaffected. The issue is fixed in version 5.0.5.

CVE-2026-68572 is a high-severity vulnerability in Apache Kylin that allows exposure of sensitive information to unauthorized actors. It affects Apache Kylin versions from 4.0.0 up to and including 5.0.4. The vulnerability is addressed in version 5.0.5, which users are strongly advised to upgrade to.

CVE-2026-48503 is an integer underflow vulnerability in the MMS file service of libIEC61850 versions prior to 1.6.2. The flaw allows an unauthenticated remote client to cause an out-of-range initialPosition in fileOpen, leading to an oversized response that can disclose stale data from previous responses. This can result in information disclosure without authentication. The issue is fixed in version 1.6.2.

CVE-2026-57447 is a medium severity vulnerability in the discourse-doc-categories plugin for Discourse. The issue involves exposure of sensitive information where the doc category index refresh resolves linked titles for private messages or restricted category topics without enforcing viewer authorization. This allows a user with permission to edit the index topic to learn titles of topics they are not authorized to view, though access to the topic contents is not granted. The vulnerability has been addressed by a specific commit in the source code.

Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.