The Librarian `supervisord` status page can be retrieved by the `web_fetch` tool, which can be used to retrieve running processes within TheLibrarian backend. The vendor has fixed the vulnerability in all affected versions.
CVE-2026-0616 is a high-severity vulnerability in TheLibrarian.io's web_fetch tool that allows unauthorized users to retrieve the Adminer interface content. This exposure enables attackers to access the internal backend system without authentication, compromising sensitive system information. The vulnerability does not require user interaction or privileges and can be exploited remotely over the network. Although no known exploits are currently in the wild, the flaw poses a significant confidentiality risk. The vendor has released patches addressing this issue in all affected versions. European organizations using TheLibrarian.io should prioritize patching to prevent unauthorized backend access. Countries with higher adoption of TheLibrarian.io or critical infrastructure relying on it are at greater risk.
CVE-2026-0613 is a high-severity vulnerability in TheLibrarian.io that allows unauthorized internal port scanning via SSRF-like behavior through its web_fetch tool. This flaw exposes sensitive system information by enabling attackers to perform GET requests to internal IP addresses and services within the Hetzner cloud environment used by TheLibrarian. The vulnerability does not require authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently in the wild, the vendor has released patches for all affected versions. European organizations using TheLibrarian.io, especially those hosted on Hetzner infrastructure, are at risk of internal network reconnaissance that could facilitate further attacks. Mitigation involves promptly applying vendor patches, restricting internal service exposure, and monitoring for unusual internal request patterns. Countries with significant Hetzner data center presence and TheLibrarian adoption, such as Germany and the Netherlands, are most likely to be affected.
CVE-2026-0612 is a high-severity information leakage vulnerability in TheLibrarian.io's web_fetch tool that allows attackers to retrieve arbitrary external content via the platform, effectively proxying requests through TheLibrarian infrastructure. This flaw exposes sensitive system information to unauthorized parties without requiring authentication or user interaction. The vulnerability impacts confidentiality but does not affect integrity or availability. Although no known exploits are reported in the wild, the ease of exploitation and network accessibility make it a significant risk. The vendor has released patches for all versions, and organizations using TheLibrarian.io should apply updates immediately. European organizations relying on TheLibrarian.io for content retrieval or proxying services are at risk of data exposure and potential indirect attacks. Countries with higher adoption of TheLibrarian.
Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access information which would otherwise be restricted. This has low impact on confidentiality of the application, integrity and availability are not impacted.
CVE-2026-0853 is a medium severity vulnerability affecting the A-Plus Video Technologies AP-RM864P NVR devices. It allows unauthenticated remote attackers to access a debug page, exposing sensitive device status information. The vulnerability does not require user interaction or authentication and can be exploited over the network with low complexity. Although no known exploits are currently reported in the wild, the exposure of sensitive system information could aid attackers in further targeting the device or network. European organizations using these NVR models may face risks related to confidentiality breaches and potential reconnaissance by attackers. Mitigation involves restricting network access to the device, disabling debug interfaces if possible, and monitoring network traffic for unauthorized access attempts. Countries with higher adoption of A-Plus Video Technologies products or critical infrastructure relying on these NVRs are more likely to be affected. Given the CVSS score of 6.9, the vulnerability is considered medium severity but warrants prompt attention to prevent escalation.
The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valuable information for an attacker.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EngoTheme Plant - Gardening & Houseplants WordPress Theme allows Retrieve Embedded Sensitive Data.This issue affects Plant - Gardening & Houseplants WordPress Theme: from n/a through 1.0.0.
An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data.
We have already fixed the vulnerability in the following versions:
QTS 5.2.8.3332 build 20251128 and later
QuTS hero h5.2.8.3321 build 20251117 and later
QuTS hero h5.3.1.3250 build 20250912 and later
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Digages Direct Payments WP direct-payments-wp allows Retrieve Embedded Sensitive Data.This issue affects Direct Payments WP: from n/a through <= 1.3.2.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah BoomDevs WordPress Coming Soon coming-soon-by-boomdevs allows Retrieve Embedded Sensitive Data.This issue affects BoomDevs WordPress Coming Soon: from n/a through <= 1.0.4.
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sharp Display Solutions projectors allows a attacker may improperly access the HTTP server and execute arbitrary actions.
AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.
Student Learning Assessment and Support System developed by JHENG GAO has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to view a specific page and obtain test accounts and password.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.32.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Hiroaki Miyashita Custom Field Template custom-field-template allows Retrieve Embedded Sensitive Data.This issue affects Custom Field Template: from n/a through <= 2.7.6.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Retrieve Embedded Sensitive Data.This issue affects WP Hotel Booking: from n/a through <= 2.2.7.
