FOGProject's fogproject prior to version 1.5.10.1870 contains a vulnerability where the management adInfo() endpoint discloses the default domain-join password in a JSON response without requiring authentication. This exposure allows remote unauthenticated actors to obtain sensitive credentials, potentially compromising domain-join security. The issue is fixed in version 1.5.10.1870.
Discourse versions prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 contain a vulnerability where media and attachments uploaded in public categories retained public accessibility flags even after the categories became read-restricted or permissions changed. This allowed anonymous users to access these uploads via short URLs, including those linked to deleted topics. The issue has been fixed in the specified versions.
CVE-2026-14851 is a critical vulnerability in Copart’s online billing service that exposes sensitive customer information such as names, addresses, invoice numbers, payment details, and tax information. The flaw arises from missing authorization checks on the endpoint serving PDF invoice files, allowing unauthorized access. Additionally, some invoice document URLs are publicly indexed by search engines, further exposing confidential data. Exploiting this vulnerability enables attackers to access and potentially enumerate sensitive financial and personal data.
The Appointment Booking Plugin – LatePoint for WordPress versions up to 5.7.3 contains a vulnerability that allows authenticated users with subscriber-level access or higher to expose sensitive booking information. This occurs via the 'params[customer][first_name]' parameter, enabling attackers to extract privileged data such as admin notes, internal contact details, transaction tokens, and payment URLs through notification emails. The issue arises when a crafted placeholder is stored in the first_name field and triggers the password-reset email flow, revealing sensitive information.
CVE-2026-96904 is a medium severity information exposure vulnerability in the AWP Classifieds WordPress plugin before version 4.4.9. It allows unauthenticated attackers to bypass ownership checks on the ad submission page by referencing a payment transaction, enabling them to read private contact emails stored on any listing.
CVE-2026-90989 is an information exposure vulnerability in the Tainacan WordPress plugin versions before 1.4.0. The plugin's reports REST endpoints do not restrict access to users with management capabilities, allowing any authenticated subscriber to read email addresses of the repository's staff. This vulnerability has a medium severity with a CVSS score of 4.3.
GamiPress WordPress plugin versions from 7.9.5 up to but not including 8.0.6 have an information exposure vulnerability. This flaw allows unauthenticated users to access private activity log entries of all users due to improper authorization. It is a partial fix of a previous vulnerability (CVE-2026-13450).
CVE-2026-106099 is a medium severity information exposure vulnerability in the WP Data Access WordPress plugin versions before 5.5.84. The plugin does not properly restrict its database table export action to authorized users, relying only on a token that is publicly exposed on pages displaying tables. This allows unauthenticated attackers to export the full contents of any publicly displayed table, including data not shown to regular visitors.
CVE-2026-105969 is a medium severity information exposure vulnerability in the CodeAtoZ B2B Suite for WooCommerce WordPress plugin versions before 1.6.1. It allows unauthenticated users to access guest-submitted quotes by enumerating identifiers, exposing sensitive information such as buyer names, email addresses, and requested line items.
The Avada (Fusion) Builder WordPress plugin up to version 3.16.1 contains a vulnerability that allows unauthenticated attackers to access sensitive user information. This is due to improper exposure of user meta data via the 'args[link_target]' parameter. Attackers can retrieve administrator emails, login names, user levels, and WooCommerce customer personally identifiable information such as billing email, phone, and address. The required nonce to exploit this is publicly exposed on pages using the [fusion_instagram] shortcode, enabling anonymous harvesting.
CVE-2026-85891 is a vulnerability in Microsoft Azure HDInsight that allows unauthorized actors to access sensitive information over the network. The flaw involves exposure of sensitive data without proper authorization controls. This vulnerability has a high severity score of 7.5 and affects version 1.0 of Azure HDInsight. Microsoft has issued an official fix for this vulnerability and manages remediation for this cloud-hosted service.
### Summary
`dio_http2_adapter` follows HTTP `Location` redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin `302` redirect receives the victim's `Authorization`, `Cookie`, and `Proxy-Authorization` headers verbatim. This vulnerability has a CVSS v3.1 base score of **7.5 (High)** because `followRedirects` is enabled by default, no authentication is required to exploit it, and the confidentiality impact is high.
### Details
When `Dio` is configured to use `Http2Adapter`, the adapter's internal `_fetch` method constructs HTTP/2 request headers by unconditionally copying all entries from `options.headers`:
```dart
// plugins/http2_adapter/lib/src/http2_adapter.dart:111
headers.addAll(
options.headers.entries.map((entry) {
...
return Header.ascii(entry.key.toLowerCase(), v);
}).toList(),
);
```
On receiving a `3xx` response, the adapter reads the `Location` header and resolves the redirect target URI:
```dart
// plugins/http2_adapter/lib/src/http2_adapter.dart:254-263
final url = responseHeaders.value('location');
final uri = Uri.parse(url ?? '');
final String path = resolveRedirectUri(options.uri, uri).toString();
return _fetch(options.copyWith(path: path, maxRedirects: --options.maxRedirects), ...);
```
`options.copyWith` is called without an explicit `headers` argument; `dio/lib/src/options.dart:629` therefore preserves the full original header map via `headers ?? Map.from(this.headers)`. `resolveRedirectUri` (`http2_adapter.dart:290`) returns an attacker-controlled cross-origin URI without any origin comparison. The combination means that on every redirect, the full set of original sensitive headers — including `Authorization`, `Cookie`, and `Proxy-Authorization` — is forwarded to the new authority with no sanitization.
**Data flow (source → sink):**
1. `dio/lib/src/dio_mixin.dart:383` — public `Dio.request<T>(String path, ...)` entry point.
2. `dio/lib/src/options.dart:331` — base and per-request headers merged into `RequestOptions`.
3. `dio/lib/src/dio_mixin.dart:596` — `httpClientAdapter.fetch(reqOpt, ...)` dispatches to `Http2Adapter`.
4. `plugins/http2_adapter/lib/src/http2_adapter.dart:254` — `Location` header is read from the network response (attacker-controlled source).
5. `plugins/http2_adapter/lib/src/http2_adapter.dart:258` — redirect target URI resolved; cross-origin check absent.
6. `plugins/http2_adapter/lib/src/http2_adapter.dart:260` — `options.copyWith(path: path, ...)` called without `headers` override.
7. `dio/lib/src/options.dart:629` — `copyWith` preserves `Map.from(this.headers)` — all sensitive headers retained.
8. `plugins/http2_adapter/lib/src/http2_adapter.dart:111` — preserved headers emitted verbatim to the cross-origin HTTP/2 request (sink).
**Suggested patch** — strip sensitive headers before following a cross-origin redirect:
```diff
--- a/plugins/http2_adapter/lib/src/http2_adapter.dart
+++ b/plugins/http2_adapter/lib/src/http2_adapter.dart
+ static const _sensitiveRedirectHeaders = {
+ 'authorization',
+ 'cookie',
+ 'proxy-authorization',
+ };
+
- final String path = resolveRedirectUri(options.uri, uri).toString();
+ final redirectUri = resolveRedirectUri(options.uri, uri);
+ final redirectOptions = options.copyWith(
+ path: redirectUri.toString(),
+ maxRedirects: --options.maxRedirects,
+ );
+ if (!_sameOrigin(options.uri, redirectUri)) {
+ redirectOptions.headers.removeWhere(
+ (name, _) => _sensitiveRedirectHeaders.contains(name.toLowerCase()),
+ );
+ }
return _fetch(
- options.copyWith(path: path, maxRedirects: --options.maxRedirects),
+ redirectOptions,
list != null ? Stream.fromIterable(list) : null,
cancelFuture,
redirects,
);
+
+ static bool _sameOrigin(Uri a, Uri b) =>
+ a.scheme == b.scheme && a.host == b.host && a.port == b.port;
```
### PoC
The following steps reproduce the vulnerability using two local HTTP/2 cleartext (h2c) servers inside an isolated Docker container (no external network required).
**Prerequisites:**
- Docker installed and accessible.
- Repository checked out at the path used as the build context.
**Build and run:**
```bash
# From the repository root (github_web_81_cfug__dio/)
docker build -f vuln-001/Dockerfile -t dio-vuln-001:poc .
docker run --rm --network none dio-vuln-001:poc
```
**What the container does:**
1. Starts an *origin* h2c server on `127.0.0.1:18081` that immediately returns `302 Location: http://127.0.0.1:18082/capture`.
2. Starts an *attacker* h2c server on `127.0.0.1:18082` that logs every received header.
3. Executes the following Dart exploit:
```dart
final dio = Dio()
..httpClientAdapter = Http2Adapter(ConnectionManager());
await dio.get(
'http://127.0.0.1:18081/start',
options: Options(headers: {
'Authorization': 'Bearer SECRET
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.
Plane, an open-source project management tool, has a vulnerability prior to version 1.4.0 where unauthenticated GET requests to a specific API endpoint expose secret invitation tokens. This allows an attacker to retrieve invitation tokens intended for other users and join workspaces without an invitation, gaining assigned roles. The issue is fixed in version 1.4.0.
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check. An authenticated caller can consequently infer or read data from notes outside the caller's read ACL. Version 1.3.1 fixes the vulnerability by filtering path-attributable fields and applying the read whitelist to list_templates.
The Ad Inserter – Ad Manager & AdSense Ads WordPress plugin versions up to 2.8.18 contain a vulnerability that allows authenticated users with subscriber-level access or higher to access sensitive server and site information. This includes internal IP addresses, PHP configuration, WordPress and theme versions, plugin data, and protected keys such as API tokens. The vulnerability arises via the ai_wp_footer_hook and exposes sensitive information to unauthorized actors.
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process.
IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files.
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response.