CVE-2026-48503 is an integer underflow vulnerability in the MMS file service of libIEC61850 versions prior to 1.6.2. The flaw allows an unauthenticated remote client to cause an out-of-range initialPosition in fileOpen, leading to an oversized response that can disclose stale data from previous responses. This can result in information disclosure without authentication. The issue is fixed in version 1.6.2.
CVE-2026-57447 is a medium severity vulnerability in the discourse-doc-categories plugin for Discourse. The issue involves exposure of sensitive information where the doc category index refresh resolves linked titles for private messages or restricted category topics without enforcing viewer authorization. This allows a user with permission to edit the index topic to learn titles of topics they are not authorized to view, though access to the topic contents is not granted. The vulnerability has been addressed by a specific commit in the source code.
Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.
Mattermost versions 11.7.0, 11.8.0, 11.9.0, and 11.10.0 contain a vulnerability where action integration secrets are not properly stripped from post payloads before broadcasting post-deletion websocket events and returning thread API responses. This flaw allows authenticated channel members to access sensitive server-side webhook URLs and authentication context from interactive-message posts via the post_deleted websocket event or the threads REST API.
The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to extract complete logged mail rows belonging to other users — including recipient addresses, message subjects, full message bodies, and any URLs contained therein — whose addresses happen to match the wildcard. Exploitation requires an administrator to process a personal-data export request for the attacker's email address via the standard WordPress privacy workflow, and the attacker's address must contain a LIKE wildcard character (such as an underscore) that matches at least one other user's address in the mail log.
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.5 via the 'woof_settings[woof_stat][server_options]' parameter. This makes it possible for unauthenticated attackers to extract the external MySQL host, database name, username, and plaintext password stored in woof_settings[woof_stat][server_options] from the inline woof_tm_data script object on any public frontend filter page. This is only exploitable when an administrator has enabled the Statistics extension, saved external MySQL connection credentials, and enabled Turbo Mode — all supported, documented plugin configurations.
The Product Delivery Date for WooCommerce WordPress plugin before 3.3.2 does not perform a capability check before disclosing order details through its calendar view AJAX actions, allowing users with a role as low as Contributor to view other customers' order information.
The Salon Booking System WordPress plugin before 10.31.3 does not restrict several of its booking REST API routes to users with the appropriate capability, allowing any authenticated user such as a subscriber to read every customer's booking records, including their personal data.
The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.
The Document Gallery WordPress plugin through 5.1.1 does not perform any capability or ownership check when generating a gallery on demand, allowing unauthenticated users to enumerate and disclose the titles, descriptions and direct file URLs of media attached to unpublished, private or trashed content.
The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it to unauthenticated users and rendering the webhook's signature check ineffective. This allows unauthenticated attackers to forge payment-confirmation notifications and record arbitrary donations as completed, with attacker-chosen amounts, donor names and messages.
The Subscribe to Comments WordPress plugin before 2.3.3 does not sign or validate a cookie it trusts to identify a commenter, allowing unauthenticated attackers to disclose a subscriber's management key and silently alter that subscriber's subscriptions.
The Image Hub plugin for WordPress versions up to and including 1.2.0 exposes plaintext API credentials for six third-party image services to authenticated users with subscriber-level access or higher. These credentials are embedded in every admin page's HTML via wp_localize_script. Additionally, the plugin leaks a valid AJAX nonce and lacks capability checks in its AJAX handler, allowing subscriber-level users to overwrite stored API credentials.
CVE-2026-77711 is a high-severity information exposure vulnerability in Eclipse Jetty's HttpClient. When making requests through a forward proxy, if the server responds with a 407 Proxy Authentication Required status, the client incorrectly treats this as a proxy challenge and resends the request with proxy authentication headers. This causes the proxy credentials to be sent to the server, exposing sensitive authentication information.
CVE-2026-76184 is a high-severity vulnerability in Eclipse Jetty's HttpClient where improper path normalization in redirects can cause authentication credentials to be sent to unintended paths. Specifically, if a redirect contains a path like '/secure/../evil', HttpClient matches credentials against '/secure' instead of normalizing to '/evil', potentially exposing the Authorization header to an attacker-controlled path on the same domain.
FileRise Pro versions prior to 3.24.0 contain a vulnerability where the /api/pro/portals/get.php endpoint exposes sensitive internal client portal information to unauthenticated users who know or guess the portal slug. This includes internal storage paths, client emails, form settings, and upload policies. The issue requires the Pro add-on and at least one configured portal. It is fixed in version 3.24.0.
FileRise versions prior to 3.20.0 contain a vulnerability where the /api/file/snippet.php endpoint does not enforce an authenticated-session guard before processing short text preview requests. While the endpoint performs access control list (ACL) checks, unauthenticated requests can reach the ACL evaluation stage instead of being immediately rejected with a 401 response. Exploitation requires unusual proxy-header or ACL misconfiguration. This issue is fixed in version 3.20.0.
CVE-2026-55682 is a high-severity vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.6 have a flaw in the session handling mechanism where an attacker-supplied PHPSESSID cookie is reflected in the Set-Cookie response with the internal database host name exposed as the cookie domain. This allows an attacker to hijack authenticated sessions if a victim uses the attacker-chosen session identifier. The issue affects all PHP pages and is fixed in version 3.8.6.
A path traversal vulnerability exists in dbt-labs dbt-core versions from 2.0.0-alpha.0 up to but not including 2.0.0-alpha.5. The dbt docs serve component exposes an unauthenticated POST /api/v1/query endpoint that allows clients to execute SQL queries via DuckDbViewsBackend without authorization or an allowlist. This enables reading of arbitrary files accessible to the dbt process, including files outside the intended docs index directory. The server binds to localhost by default but can be exposed to a network, increasing risk. The issue is fixed in version 2.0.0-alpha.5.