CWE-201 vulnerabilities

Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.

Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.

In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce the AI agent to construct image URLs encoding sensitive information from the workspace or conversation context, exfiltrating it to attacker-controlled servers. The workspace trust enforcement introduced in v1.71.0 mitigates the documented attack chain by disabling AI features in untrusted workspaces.

Insertion of sensitive information into sent data vulnerability in MarketingFire Widget Options allows Retrieve Embedded Sensitive Data. This issue affects Widget Options: from n/a through 4.0.1.

CVE-2026-52698 is a high-severity vulnerability in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget versions up to 4.2.3. It involves the insertion of sensitive subscriber data into sent data, leading to potential exposure of this information. The vulnerability is classified under CWE-201, indicating sensitive information exposure through data insertion. No official patch or remediation guidance is currently provided by the vendor.

An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerable software could obtain privilege information by using the command Version via the path: /upgrade/query.php?cmd=p+3&3Bversion resulting in a information disclosure. This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.05.10.02.

Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions.

Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.

Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions.

Subscriber Sensitive Data Exposure in Chatway Live Chat &#8211; AI Chatbot, Customer Support, FAQ &amp; Helpdesk Customer Service &amp; Chat Buttons <= 1.4.8 versions.

Subscriber Sensitive Data Exposure in XCloner <= 4.8.6 versions.

CVE-2026-42384 is a high-severity vulnerability in NSquared's Simply Schedule Appointments software versions prior to 1.6.11.2. It involves unauthenticated exposure of sensitive data due to insertion of sensitive information into sent data. The vulnerability does not require user interaction or privileges to exploit and impacts confidentiality without affecting integrity or availability.

Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions.

CVE-2026-39480 is a high-severity vulnerability in Inisev Backup Migration versions up to and including 2.1.1. It allows unauthenticated attackers to cause sensitive data exposure by inserting sensitive information into sent data. This vulnerability is categorized under CWE-201, which involves the insertion of sensitive information into data sent over a network. No official patch or remediation has been confirmed as of the publication date.

CVE-2026-49064 is a vulnerability in Stiofan GetPaid that allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. It affects versions up to and including 2.8.49. The vulnerability has a high severity with a CVSS score of 7.5. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and receive, in the HTTP 201 response of POST /api/v1/automations/workflows, both the cleartext database password in request.connection.config.password and the ingestion bot JWT in openMetadataServerConnection.securityConfig.jwtToken. The leaked ingestion-bot token can then be reused as Authorization: Bearer <jwt> to access sensitive service APIs with bot-level privileges. This issue has been patched in version 1.12.4.

Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 return sensitive data to the user which are not required for the client’s operation. Version 2.4.28 contains a patch.

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as `Authorization: Bearer <token>`, the value could become visible in browser history, copied links, and server/proxy/CDN access logs after a page reload or shared request. Version 0.315.4 patches the issue.

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the `api_key` field in gateway secrets can accept `$ENV_VAR` references, which are resolved against the MLflow server's environment during runtime. The resolved secrets are then sent in provider authentication headers to the configured upstream `api_base`. This vulnerability can be exploited by low-privileged authenticated users in basic-auth deployments or by unauthenticated users in default deployments without `basic-auth`. The impact includes potential leakage of sensitive credentials such as cloud artifact credentials (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`), which could lead to artifact poisoning and cross-boundary code execution in downstream environments. The issue is fixed in version 3.11.0.