A vulnerability in the undici HTTP client for Node.js allows sensitive headers such as Authorization and Cookie to be exposed to unauthorized actors during cross-origin redirects when headers are supplied as an array of tuples. This bypasses intended header stripping and can disclose origin-bound credentials. The issue affects versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3 and is fixed in versions 7.30.2 and 8.12.4.
A vulnerability in the PublishPress Revisions WordPress plugin before version 4.3.1 allows any authenticated user, including those with minimal privileges such as Subscribers, to access the title, content, and excerpt of other users' private, draft, pending, scheduled, or trashed posts via the revision-comparison feature.
CVE-2026-111769 is a vulnerability in the @modelcontextprotocol TypeScript SDK and client that allows exposure of sensitive information to unauthorized actors via HTTP redirects. Versions prior to 1.32.0 of @modelcontextprotocol/sdk and from 2.0.0 up to but not including 2.3.0 of @modelcontextprotocol/client improperly follow HTTP redirects to different origins while retaining custom headers and request bodies. This can lead to leaking API keys, session IDs, OAuth refresh tokens, and client secrets to malicious or compromised servers. The issue is fixed in versions 1.32.0 and 2.3.0 respectively.
OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate temp_authuserid and load that account's user_settings before authentication succeeds. Existing usernames can therefore cause an additional database query and may apply visible customized settings, while nonexistent usernames skip that behavior. A remote unauthenticated actor can use timing or page differences to enumerate valid accounts for later credential attacks. This issue is fixed in version 8.3.0.
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the webroot admin.php multisite administration page is enabled without an authentication check, reads database configuration from sqlconf.php, and connects to each configured site database. An unauthenticated network actor can obtain site identifiers, database names, site names, exact OpenEMR versions and patch levels, pending upgrade status, and direct login and patient-portal links. This issue is fixed in version 8.3.0.
OpenEMR versions prior to 8.2.0 contain a vulnerability where patient documents are stored with predictable filenames in a publicly accessible location. This allows unauthenticated actors who can guess or obtain the URL to access sensitive patient documents. The issue is fixed in version 8.2.0.
CVE-2026-116780 is an out-of-bounds read vulnerability in FreeSWITCH prior to version 1.11.2. The flaw occurs in the function switch_event_expand_headers_check() when a positive offset in variable expansion exceeds the variable's length, causing adjacent heap memory to be appended to the expansion result. This can lead to unintended disclosure of sensitive data such as channel variables, credentials, allocator data, and pointer bytes. The vulnerability is exploitable through configuration templates or authenticated Event Socket commands but not through ordinary dialplan slicing. The issue is fixed in FreeSWITCH version 1.11.2.
OpenHuman versions prior to 0.57.5 use the JSON-RPC bearer token as an approval session identifier, which is exposed in persisted approval records, events, debug logs, and RPC responses. This exposure allows an attacker who obtains these artifacts to recover the token and access the core RPC interface with the privileges of the token. The vulnerability can lead to exposure of sensitive agent and integration data and permit privileged operations. The issue is fixed in version 0.57.5.
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the local server exposes the server-sent events endpoint at /events without bearer authentication, permits cross-origin browser access, and uses only a caller-supplied client_id to select WebChannelEvent objects from the process-wide event bus. An unauthenticated local client, or an attacker-hosted web page opened by the victim, can subscribe to another client's stream by supplying a known or guessed identifier; the fixed system identifier makes the proactive-message stream predictable. The exposed events can include complete assistant responses, streamed message content, tool names, tool arguments, and raw tool outputs intended for the local user interface. This issue is fixed in version 0.56.0.
CVE-2026-73580 is a missing authorization vulnerability in Apache OFBiz up to version 24.09.07. It allows a remote unauthenticated attacker to recursively enumerate sensitive Human Resources data, including department and employee identifiers, position names, and organizational relationships. The issue is fixed in version 24.09.08.
Apache OFBiz versions prior to 24.09.08 contain a missing authorization vulnerability that allows remote unauthenticated attackers to access internal business records without permission. This affects several helper endpoints in the Human Resources, Catalog, and Order Manager applications, exposing sensitive data such as organization details, employee information, product catalog, and product-store data. The issue is fixed in version 24.09.08.
The Car Dealer (Dealership) and Vehicle sales WordPress plugin up to version 4.73 contains an information disclosure vulnerability. An unauthenticated attacker can access the title, content, and metadata of any private, draft, pending, future, or trashed post by using the single-listing AJAX action with a numeric post ID. This occurs because the plugin does not restrict this AJAX action to published content only.
The Essential Real Estate WordPress plugin before version 5.3.5 contains a vulnerability that allows unauthenticated users to access unpublished property listings and sensitive personal information of listing agents via an AJAX action lacking proper authorization checks.
Tutor LMS WordPress plugin versions from 1.6.4 up to but not including 4.2.0 expose correct quiz answers to enrolled students regardless of the configured setting to hide answers. This allows students to view answers before submitting their quiz attempts. The issue is fixed in version 4.2.0.
The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Store API GET responses (/wc/store/v1/cart and /wc/store/v1/checkout) as PUBLIC cache objects and does not vary the cache on the Cart-Token or WooCommerce session. A shopper's personalized cart/checkout response is therefore served to any later, cookie-less and token-less client as an LSCache HIT. This makes it possible for unauthenticated attackers to read another shopper's billing and shipping details (name, company, street address, email, phone), cart contents and totals, and the shopper's live Cart-Token session JWT and nonce (enabling cart/checkout-session hijack), plus order_key on the checkout endpoint.
Node Version Manager (nvm) versions 0.2.0 through 0.40.8 do not properly check if the .nvmrc file is a symbolic link. This allows an attacker to craft a symlinked .nvmrc pointing to arbitrary files, causing nvm commands to read and print the contents of those files in command output or logs. Version 0.41.0 fixes this by not printing the contents of symlinked .nvmrc files and only accepting valid version strings or aliases.
CVE-2026-104203 is a vulnerability in Traccar, an open source GPS tracking system, affecting versions from 5.1 up to but not including 6.15.0. It allows an unauthenticated attacker to bypass session and device authorization checks by exploiting a path parameter parsing discrepancy between MediaFilter and Jetty ResourceServlet. This enables read-only access to protected device media files such as photographs, audio, or video. The issue is fixed in version 6.15.0.
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together with the default scope’s credentials, and resulting in potential disclosure of those credentials to an attacker-controlled server. This affects Symfony in versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
The resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling "https://evil.example/steal" receives none. The same happens with a different port or user-info part on the same host.
This is reachable whenever an attacker controls the beginning of a URL passed to a client built with a base_uri and credentials, including those created with HttpClient::createForBaseUri() or configured under framework.http_client.scoped_clients.
To solve the issue, after resolving a relative URL against the base URI of the default scope, ScopingHttpClient now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent.
The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its shortcodes, allowing users with a role as low as Contributor to disclose the title and description of private, draft and other non-public posts.
The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.