Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration.
Nextcloud versions from 0.8.0 up to but not including 1.0.4 have a vulnerability where view filter criteria in Nextcloud Tables are exposed to users with read-only permissions. This exposure of metadata could reveal sensitive information unintentionally. The issue has been addressed and patched in versions 1.0.4 and later.
Apache ActiveMQ Broker versions before 5.19.7 and from 6.0.0 before 6.2.6 have a vulnerability that allows unauthenticated attackers to obtain sensitive metadata about durable topic subscriptions. This includes client identifiers, subscription names, topic destinations, and JMS selector expressions. The issue arises when brokers are configured with a network connector with syncDurableSubs set to true and respond to BrokerInfo commands without verifying authentication. Upgrading to versions 5.19.7 or 6.2.6 resolves this vulnerability.
HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sensitive location information is unintentionally shared. .
Tandoor Recipes versions prior to 2.6.0 do not strip EXIF metadata from uploaded WebP and GIF images. This leads to exposure of sensitive information such as GPS coordinates, camera model, timestamps, and software details to any user who can view the recipe images. The issue is fixed in version 2.6.0.
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application leaks confidential information in metadata, and files such as information on contributors and email address, on `SSM Server`.
CVE-2025-13084 is a high-severity vulnerability in Opto 22's groov View Server R1.0a where the users endpoint in the API exposes all users' metadata including API keys to any user with Editor role privileges. This exposure includes Administrator API keys, potentially allowing privilege escalation or unauthorized access to critical system functions. The vulnerability requires network access and Editor-level privileges but no user interaction, and it impacts confidentiality and availability. No known exploits are currently reported in the wild. European organizations using groov View Server in industrial control or automation environments are at risk, especially those with Editor role users who might be targeted or compromised. Mitigation requires restricting Editor role assignments, monitoring API access logs, and applying vendor patches once available. Countries with significant industrial automation sectors and Opto 22 deployments, such as Germany, France, Italy, and the UK, are most likely to be affected. The CVSS score of 7.6 reflects the high confidentiality impact and ease of exploitation with low attack complexity.
The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is exposed through a built-in Windows security feature that stores additional metadata in an NTFS alternate data stream (ADS) for all files downloaded from potentially untrusted sources.
MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existence of hidden (draft, unapproved, or soft-deleted) threads containing specified text in the title. The visibility state (`mybb_threads.visible` integer column) of threads is not validated in internal search queries, whose result is used to output a general success or failure of the search. While MyBB validates permissions when displaying the final search results, a search operation that internally produces at least one result outputs a redirect response (as a HTTP redirect, or a success message page with delayed redirect, depending on configuration). On the other hand, a search operation that internally produces no results outputs a corresponding message in the response without a redirect. This allows a user to determine whether threads matching title search parameters exist, including draft threads (`visible` with a value of `-2`), soft-deleted threads (`visible` with a value of `-1`), and unapproved threads (`visible` with a value of `0`); in addition to displaying generally visible threads (`visible` with a value of `1`). This vulnerability does not affect other layers of permissions. In order to exploit the vulnerability, the user must have access to the search functionality, and general access to forums containing the thread(s). The vulnerability does not expose the message content of posts. MyBB 1.8.39 resolves this issue.
The RomethemeKit For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.2 via the register_controls function in widgets/offcanvas-rometheme.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.5 via the render function in includes/widgets/htmega_accordion.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
