By weakness (CWE)

CWE-200: related vulnerabilities

CVEs classified under CWE-200. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

191 published vulnerabilities · page 2 of 2

• CVE-2026-54264MEDIUM 6.1

  Angular's Service Worker—a component that helps web applications work offline—has a flaw in how it handles redirects across different websites. When a Service Worker follows a redirect to another domain, it should remove sensitive information like login tokens before sending the request. Instead, it's currently passing those credentials along, potentially exposing them to untrusted external sites. An attacker can exploit this by crafting a scenario where a user's browser is redirected through the vulnerable Service Worker to a site the attacker controls, capturing credentials in the process. This affects Angular versions before 22.0.1, 21.2.17, and 20.3.25.

• CVE-2026-54276MEDIUM 6.1

  AIOHTTP, a widely-used Python framework for building asynchronous HTTP applications, contains a flaw in its DigestAuthMiddleware component that can leak user credentials across domain boundaries. When a server redirects an authenticated user to a different domain (via an open redirect or similar vulnerability), AIOHTTP may automatically resend the digest authentication response to the attacker-controlled destination. An attacker cannot directly extract plaintext passwords from the digest alone, but the digest itself becomes a credential an attacker can attempt to crack or replay if cryptography is weak or if users reuse passwords across services.

• CVE-2026-14062MEDIUM 5.9

  Google Chrome and ChromeOS have a weakness in how they handle certain view operations that could let an attacker steal sensitive data from your computer's memory. The attack requires two things: you'd need to install a malicious extension (add-on), and the attacker would craft that extension specifically to read data from Chrome's internal memory. This is a medium-severity issue because while memory access is serious, it requires social engineering to get you to install the extension first.

• CVE-2026-48189MEDIUM 5.7

  OTRS has released a security update addressing an input validation flaw in its Customer Backend module that allows authenticated users to bypass group-based access controls and view customer information they shouldn't have access to. The vulnerability requires that the CustomerGroupSupport feature is both enabled and actively used within the deployment. While the flaw is rated medium severity, it poses a direct confidentiality risk for organizations managing sensitive customer data through OTRS ticketing systems.

• CVE-2026-48210MEDIUM 5.7

  OTRS 2026.3.1 has a configuration issue where ticket forwarding automatically marks internal information as visible to customers, and administrators cannot turn this off through the user interface. This means sensitive ticket details that should remain internal can unintentionally become visible to external customers, creating a data leakage risk.

• CVE-2026-58024MEDIUM 5.7

  A MediaWiki vulnerability allows authenticated users to access sensitive information they shouldn't be able to see. The flaw is in the user rights API component and requires an attacker to be logged in and interact with a user interface element. While the exposure is limited to confidential data (no data modification or system disruption), it represents a meaningful privacy and compliance risk because sensitive administrative or user information could be leaked to unauthorized individuals.

• CVE-2026-58026MEDIUM 5.7

  A vulnerability in MediaWiki allows authenticated users to view sensitive information they shouldn't have access to through a flaw in the parser component. An attacker needs a valid login and user interaction to exploit this, limiting the attack surface but still representing a meaningful information disclosure risk in environments where many users have accounts.

• CVE-2026-32315MEDIUM 5.5

  motionEye versions before 0.44.0 store sensitive configuration files with overly permissive file access controls. Any user on the system can read the admin password hash and camera credentials from plain-text configuration files. An attacker with local access could extract these credentials, crack the password hash offline, and use it to impersonate an administrator—potentially combining this with other known flaws in motionEye to take complete control of the system.

• CVE-2026-41980MEDIUM 5.5

  A permission control flaw in a file preview module allows unauthorized access to sensitive file contents. An attacker with local access to a system can bypass intended access restrictions and view files they should not be able to preview, potentially exposing confidential information. The vulnerability requires user interaction to trigger but does not require special privileges to exploit.

• CVE-2026-42906MEDIUM 5.5

  CVE-2026-42906 is a moderate-severity information disclosure vulnerability in Windows Shell that allows an authenticated attacker with local access to read sensitive information on a system. The flaw does not enable privilege escalation, system modification, or denial of service—it is purely about unauthorized data exposure. An attacker must already have valid login credentials and local system access to exploit it, which limits the attack surface but remains a realistic threat in environments where user account compromise is a concern.

• CVE-2026-42970MEDIUM 5.5

  A flaw in Windows Push Notifications can allow a user with local access to a computer to read sensitive information that should be protected. An attacker with an existing local account on the system could potentially view data in the push notification system without authorization. This is not a remote vulnerability and requires the attacker to already have some level of access to the machine.

• CVE-2026-42971MEDIUM 5.5

  A vulnerability in Windows Push Notifications can allow an authorized user on a system to access sensitive information they should not be able to see. The flaw requires local access and valid credentials, but once those conditions are met, an attacker can read confidential data without further user interaction. This is a local information disclosure issue affecting multiple Windows versions from Windows 10 through Windows 11, as well as Windows Server 2016 through 2025.

• CVE-2026-42972MEDIUM 5.5

  A flaw in Windows Hyper-V can leak sensitive information to users who already have local access to a system. An attacker with a standard user account on the machine could exploit this to read data they shouldn't be able to access. While the vulnerability requires existing local privileges, the information exposure is significant enough to warrant attention, particularly in multi-tenant or shared system environments.

• CVE-2026-42973MEDIUM 5.5

  CVE-2026-42973 is a Windows Push Notifications vulnerability that allows an authorized user on a local machine to read sensitive information they should not have access to. This is not a remote attack—an attacker must already have a valid user account on the system. The flaw exposes confidential data without modifying or disabling any systems, making it a disclosure risk rather than a system-breaking vulnerability.

• CVE-2026-45594MEDIUM 5.5

  CVE-2026-45594 is a medium-severity information disclosure vulnerability in Windows Application Identity (AppID) Subsystem. An attacker who already has local access to a Windows machine can exploit this flaw to read sensitive information that should not be accessible to them. The vulnerability requires the attacker to have user-level privileges and does not involve any user interaction. It affects Windows 10 and Windows 11 across multiple versions, as well as Windows Server 2016 through 2025.

• CVE-2026-49219MEDIUM 5.5

  ImageMagick, widely used for image processing and manipulation, contains a vulnerability that allows a local attacker with login privileges to bypass security policies and read files that should be restricted. The flaw stems from improper handling of filenames, specifically when symlinks are involved. An attacker could exploit this to circumvent the policy restrictions ImageMagick enforces. This is not a remote vulnerability—it requires local system access and user-level permissions.

• CVE-2026-10254MEDIUM 5.3

  SourceCodester Pet Grooming Management Software version 1.0 contains a vulnerability that exposes file and directory information to unauthenticated remote attackers. An unknown function in the /admin/ path fails to properly restrict access to sensitive filesystem metadata, allowing adversaries to enumerate files and directories without authentication. While this does not permit direct modification or service disruption, the information disclosure can serve as reconnaissance for subsequent targeted attacks. Public exploit code is available.

• CVE-2026-11458MEDIUM 5.3

  A flaw in erzhongxmu JeeWMS allows unauthenticated attackers to access sensitive information through an exposed Boot Actuator Endpoint at /base-boot/actuator. The vulnerability requires no special conditions to exploit and can be triggered over the network. While the issue is rated MEDIUM severity and does not allow data modification or system disruption, the information disclosure risk warrants prompt remediation. Public exploit code is available, increasing the likelihood of opportunistic attacks.

• CVE-2026-12120MEDIUM 5.3

  The FireBox Popups plugin for WordPress contains a security flaw that allows anyone on the internet to download complete lists of form submissions, including sensitive personal information like email addresses and names, without needing to log in. An attacker simply needs to guess or identify a form ID number to retrieve all submitted data in CSV format. This affects all versions up to and including 3.1.7.

• CVE-2026-12203MEDIUM 5.3

  HKUDS AI-Trader contains a flaw in its research export functionality that allows unauthenticated attackers to access sensitive information through the /api/research/agents.csv endpoint. An attacker can remotely exploit this vulnerability without user interaction to retrieve confidential data. The issue stems from insufficient access controls on the export feature. Public exploit code exists for this vulnerability. The vendor has addressed this by enforcing authentication and capability-based authorization on research export endpoints.

• CVE-2026-14049MEDIUM 5.3

  Google Chrome contained a flaw in how it handled GPU operations that could allow an attacker to read sensitive data from memory. The attacker would need to first compromise Chrome's renderer process (the component that processes web page content) and then trick a user into visiting a malicious webpage. If successful, they could extract information that should have remained private. This issue affected Chrome versions before 150.0.7871.47 across Windows, macOS, and Linux systems.

• CVE-2026-2128MEDIUM 5.3

  The Breeze WordPress plugin through version 2.5.2 contains a flaw that allows attackers to view content meant only for administrators. When the "Cache Logged-in Users" feature is enabled, the plugin trusts cookie information without properly verifying it belongs to a real, authenticated user. An attacker can craft a fake cookie claiming to be an administrator, and the plugin will serve them the cached pages generated for that admin—exposing private posts, administrative controls, security tokens, and other sensitive data. No authentication or special privileges are required to attempt this attack.

• CVE-2026-45085MEDIUM 5.3

  Discourse, a popular open-source discussion platform, contains four separate authorization and information disclosure flaws in its chat plugin (and one overlapping with the calendar plugin). The vulnerabilities allow read-only category members to create chat threads they shouldn't, permit users to recover deleted messages even after losing channel access, expose unrelated private messages to moderators reviewing flagged content, and leak chat channel details and message content to unauthorized viewers including anonymous users. These gaps bypass intended access controls and leak sensitive conversation data. The issues affect Discourse instances with the chat plugin enabled; the calendar-related exposure additionally requires the discourse-calendar plugin.

• CVE-2026-45780MEDIUM 5.3

  Discourse, an open-source discussion platform, has a flaw in how it handles event information that could unintentionally reveal sensitive details about private events. Specifically, the names of invited groups, sample invitee lists, and attendance statistics were being exposed to anyone who could view a topic—even if they shouldn't have access to the private event's invitee information. This is a permissions boundary issue: unauthorized users gain visibility into data they're not entitled to see. The vendor has patched this across multiple supported versions.

• CVE-2026-46790MEDIUM 5.3

  Oracle WebCenter Content version 14.1.2.0.0 contains an information disclosure vulnerability that allows an unauthenticated attacker to read sensitive data over the network without requiring credentials or user interaction. The vulnerability is exposed through HTTP and rated medium severity due to its limited scope—only confidentiality is affected, with no impact to data integrity or system availability.

• CVE-2026-46830MEDIUM 5.3

  Oracle REST Data Services contains an information disclosure vulnerability in its Mongoapi component that allows an unauthenticated attacker to read sensitive data over the network without authentication. An attacker with network access can exploit this flaw via HTTPS to gain unauthorized visibility into data normally protected by REST Data Services, though they cannot modify or delete information. The vulnerability affects versions 24.2.0 through 26.1.0 and requires no special conditions—it's straightforward to trigger.

• CVE-2026-46841MEDIUM 5.3

  Oracle REST Data Services versions 24.2.0 through 26.1.0 contain a network-accessible vulnerability that allows unauthenticated attackers to read sensitive data. An attacker on the network can reach the service over HTTPS without credentials and gain unauthorized access to a subset of the data REST Data Services manages. This is not a critical vulnerability—it does not enable system takeover, data modification, or service disruption—but it does represent a meaningful confidentiality risk for organizations relying on REST Data Services for data access control.

• CVE-2026-47264MEDIUM 5.3

  Discourse, a popular open-source discussion platform, contains an information disclosure vulnerability that exposes the names of restricted tag groups to unauthorized users. When the site setting 'tags_listed_by_group' is enabled, anonymous and unprivileged users can access an endpoint that reveals tag group names—including those meant to be invisible or restricted to specific user groups. This occurs because the system failed to filter sensitive metadata based on the requesting user's actual permissions. The vulnerability affects multiple version branches and has been patched across all active release tracks.

• CVE-2026-49397MEDIUM 5.3

  Nezha Monitoring, a self-hosted server and website monitoring tool, has a flaw in versions 2.0.0 through 2.0.13 that allows attackers to discover private services that administrators intended to keep hidden. Specifically, services marked as private (with EnableShowInService set to false) can still be enumerated through per-server API endpoints, exposing their names and response timing information. An attacker with network access to a Nezha instance doesn't need credentials to exploit this—they can systematically query endpoints and infer which services exist and how they behave based on timing patterns. This undermines the intended privacy controls.

• CVE-2026-53467MEDIUM 5.3

  ImageMagick, a widely-used image editing and manipulation tool, contains a vulnerability in its MNG (Multiple-image Network Graphics) decoder that can leak sensitive memory contents. When processing certain MNG files, part of the image pixel data is not properly initialized, potentially exposing unintended information from the heap memory. An attacker can craft a malicious MNG file that, when processed by a vulnerable ImageMagick instance, causes the application to return heap data as part of the image output. This affects ImageMagick versions prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch).

• CVE-2026-53949MEDIUM 5.3

  Ghost, a popular Node.js-based content management system, contains a flaw in how it validates filter parameters on public API endpoints. Attackers can exploit this weakness to bypass security checks and access private fields that should be hidden, potentially including user password hashes. The severity of the exposure depends on the underlying database: SQLite instances leak complete password hashes, while MySQL instances lose case sensitivity information in hashes, which significantly hampers offline brute-force feasibility. The vulnerability affects Ghost versions 5.46.1 through 6.21.2, and the issue is resolved in version 6.21.2.

• CVE-2026-56218MEDIUM 5.3

  Capgo versions before 12.128.2 do not remove sensitive location data embedded in images that users upload to the platform. When someone uploads a photo taken with a smartphone or modern camera, that device typically records GPS coordinates, timestamps, and other metadata in the image file itself. Capgo fails to strip this data before storing or serving the image, meaning anyone who downloads an uploaded image can extract the precise latitude and longitude showing exactly where and when the photo was taken. This allows attackers to discover where users were physically located at specific moments, posing a privacy and safety risk.

• CVE-2026-56235MEDIUM 5.3

  Cap-go capgo versions before 12.128.2 expose a flaw where three database query functions (get_app_metrics, get_global_metrics, get_total_metrics) can be called by anyone without authentication. An attacker only needs Cap-go's public API key to request usage data for any organization, including ones they don't belong to. This allows leaking how many users each org has, bandwidth consumption, app installation counts, and which apps belong to a target organization. Additionally, an attacker can determine whether a specific organization exists in the system.

• CVE-2026-56282MEDIUM 5.3

  Capgo versions before 12.128.2 expose sensitive database replication information through an unauthenticated endpoint. An attacker can access the /replication endpoint without logging in to retrieve PostgreSQL replication slot names, write-ahead log (WAL) positions, and other infrastructure telemetry. This reconnaissance data could help an adversary understand your database topology and replication strategy without needing valid credentials.

• CVE-2026-56284MEDIUM 5.3

  Capgo, a platform for managing mobile app updates, has an information disclosure flaw that allows anyone on the internet to retrieve sensitive operational metrics about organizations using the service. An attacker doesn't need valid credentials—they only need a valid organization identifier (UUID) and can then extract data like monthly active users, bandwidth consumption, and app installation counts. This works because a backend database function that should be restricted is accidentally callable by anonymous users. The vulnerability was patched in version 12.128.2.

• CVE-2026-56318MEDIUM 5.3

  Capgo versions before 12.128.2 contain a flaw that leaks information about which organization IDs exist in the system. An attacker without any authentication can send requests to a password validation endpoint and observe whether the system returns different error messages or status codes depending on whether an organization ID is real or fake. By systematically probing the endpoint, an attacker can build a list of valid organization UUIDs, effectively enumerating the platform's organizational structure. This is a reconnaissance-enabling vulnerability that does not allow direct data theft or system manipulation on its own, but significantly reduces the attacker's reconnaissance effort.

• CVE-2026-56337MEDIUM 5.3

  Capgo versions before 12.128.2 expose a flaw that lets anyone on the internet discover which app IDs exist in the platform's database. An unauthenticated attacker can probe the system by sending requests to a specific endpoint, learning whether apps with particular IDs have been registered. This leaks information across different tenants and undermines privacy boundaries—an attacker could methodically enumerate apps belonging to other organizations.

• CVE-2026-57994MEDIUM 5.3

  phpMyFAQ versions before 4.1.5 contain a flaw that allows anyone on the internet to view draft or unpublished FAQ content that administrators intended to keep private. The vulnerability stems from inconsistent filtering rules across different API endpoints—some endpoints check whether content should be public before returning it, while others do not. An attacker can exploit this by querying the API directly to retrieve full FAQ text, question titles, and preview content from inactive items.

• CVE-2026-59828MEDIUM 5.3

  Discourse, an open-source discussion platform, contains a vulnerability that allows post revision history to leak information that should remain hidden from regular users. When users view adjacent post revisions, the serialization process can expose diffs that include content from hidden revisions. This affects instances running Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, or 2026.1.5. The leak occurs through normal diff display functionality rather than requiring special privileges, though the impact is limited to information disclosure.

• CVE-2026-6046MEDIUM 5.3

  Mattermost has a vulnerability in its bot registration process that fails to properly verify bot account ownership. An attacker with basic user access can register a standard user account using a name that matches a plugin bot's predictable username. This allows them to intercept private messages intended for that bot—messages that often contain sensitive information passed between plugins and administrators. The vulnerability affects multiple Mattermost versions across the 11.6, 11.5, and 10.11 release lines.

• CVE-2026-8385MEDIUM 5.3

  The WP Go Maps WordPress plugin contains an access control flaw that exposes unapproved map markers to anyone on the internet. Site owners use marker approval workflows to control which locations, names, and descriptions appear publicly on their maps. This vulnerability bypasses that approval gate through a fallback admin endpoint, leaking sensitive location data—including titles, categories, addresses, and descriptions—to unauthenticated visitors. The issue affects all versions before 10.0.10.

• CVE-2026-9612MEDIUM 5.3

  The WhatsOrder – Instant Checkout for WooCommerce plugin contains a flaw that allows anyone on the internet to download customer invoices without logging in. The plugin saves invoice files to a web-accessible folder without proper access controls, and because invoice file names are predictable (based on sequential order IDs), attackers can systematically retrieve invoices for any customer. Each invoice contains sensitive personal information including names, email addresses, phone numbers, billing addresses, purchased items, prices, and order totals.

• CVE-2026-50224MEDIUM 4.9

  The Acer Connect M6E 5G router's web administration panel is configured to listen on all public IPv6 addresses on port 8080, without built-in firewall protections. This means the internal API endpoints used to manage the device can be reached directly over the internet by anyone who knows the device exists and its IPv6 address, potentially allowing unauthorized access to sensitive configuration and status information.

• CVE-2026-50009MEDIUM 4.8

  Netty, a widely-used framework for building network applications, contains a flaw in its QUIC protocol implementation that leaks sensitive reset tokens onto the network. These tokens act like cryptographic keys that allow an attacker positioned on the network path to forge denial-of-service packets and disrupt connections. The vulnerability requires the attacker to be on-path and able to observe traffic, but no special privileges or user interaction are needed. This affects Netty versions before 4.2.15.Final.

• CVE-2026-12311MEDIUM 4.7

  CVE-2026-12311 is a sandbox escape vulnerability in Firefox and Thunderbird that can leak information to an attacker. The flaw exists in the process sandboxing security component and requires user interaction—such as clicking a link or visiting a malicious webpage—to trigger. While the vulnerability is rated as medium severity, it undermines a critical security boundary, allowing an attacker to read sensitive information that should be isolated within the sandbox. This affects current-generation Firefox and Thunderbird releases.

• CVE-2026-10854MEDIUM 4.3

  CVE-2026-10854 is a visibility control flaw in MISP's event template creation feature that allowed unauthorized users to see private galaxy data from other organizations. When creating an event template, the system listed all enabled galaxies without checking whether the user's organization owned them or whether they were marked private. This exposed sensitive metadata like galaxy type and description to users who shouldn't have access. The vulnerability requires authentication to exploit and affects only information disclosure—no data modification or denial of service is possible. MISP has patched the issue by filtering galaxy visibility based on organization ownership and distribution settings.

• CVE-2026-10864MEDIUM 4.3

  A flaw in MISP's dashboard widgets allows authenticated users with low-level access to bypass field restrictions and view sensitive information they shouldn't have access to. By manipulating which data fields the New Users and New Organisations widgets display, attackers can circumvent settings designed to hide user email addresses and other restricted organization metadata. The vulnerability stems from how the application processes field filtering—if redaction leaves the field list empty, it falls back to returning unfiltered data instead of enforcing safe defaults.

• CVE-2026-11162MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how the browser handles CSS that can allow attackers to steal data from other websites. An attacker would need to trick a user into visiting a malicious webpage, but once there, the flawed CSS implementation could expose sensitive information from pages the user has open in other tabs or windows. The risk is limited to information disclosure—the vulnerability does not allow attackers to modify data or crash the browser.

• CVE-2026-11357MEDIUM 4.3

  The Kadence Blocks page builder plugin for WordPress exposes sensitive credentials to unauthorized viewing. When a site administrator connects a Kadence account license, the full credential set—including license keys, email addresses, and API tokens—becomes readable by any contributor-level user directly through the browser console. No complex attack is needed; the credentials are simply sitting in client-side JavaScript variables.

• CVE-2026-12111MEDIUM 4.3

  The Appointment Booking Calendar plugin for WordPress contains a vulnerability that allows low-privilege users (Contributors and above) to view sensitive customer booking information they shouldn't have access to. Specifically, attackers can manipulate a query parameter to retrieve email addresses, names, phone numbers, booking times, and comments from any calendar in the system. The flaw stems from inadequate permission checks—the plugin only verifies basic admin access rather than confirming whether a user owns or manages the specific calendar being queried.

• CVE-2026-12117MEDIUM 4.3

  Devolutions Server 2026.2.5 contains an access control flaw that allows authenticated users to view metadata about social login configurations they shouldn't have permission to access. An attacker with a valid vault membership can craft specific API requests to enumerate social login entry details, potentially revealing sensitive integration information. This is a low-risk exposure of metadata rather than a direct compromise mechanism, but it can aid reconnaissance or inform follow-up attacks against connected identity systems.

• CVE-2026-12320MEDIUM 4.3

  A flaw in Firefox and Thunderbird's Password Manager allows sensitive credential information to be disclosed to an attacker under certain conditions. The vulnerability requires user interaction to exploit—an attacker cannot trigger it remotely without the user taking action. The exposure is limited to confidentiality; attackers cannot modify data or cause service disruption. Mozilla has addressed this issue in Firefox 152 and Thunderbird 152.

• CVE-2026-12408MEDIUM 4.3

  A WordPress security plugin called Slim SEO has a flaw that allows contributors and editors to read content they shouldn't be able to see. Specifically, the plugin's AI-powered REST API endpoint for generating meta tags doesn't properly verify user permissions before returning summaries of post content. An attacker with basic contributor-level access can request summaries of private posts, drafts, or password-protected content written by other users, and the plugin will generate and return AI-powered summaries that expose the underlying content. This is a classic authorization bypass where the plugin checks if a user can edit posts in general, but doesn't confirm they have permission to access the specific post being requested.

• CVE-2026-14611MEDIUM 4.3

  DeepMyst Mysti versions up to 0.4.0 contain a flaw in the Per-Project Auto-Memory Handler that allows an authenticated attacker to access sensitive resource information by manipulating the workspace path argument passed to the memory initialization function. The vulnerability requires valid user credentials and network access but does not enable modifications or service disruption.

• CVE-2026-15329MEDIUM 4.3

  CowAgent, an open-source AI agent framework, contains a vulnerability in its Browser Tool component that can leak sensitive information to authenticated users. The flaw exists in the navigation function and requires an attacker to already have login credentials. While the technical bar to exploit this is low and a proof-of-concept has been publicly released, the impact is limited to information disclosure affecting only the confidentiality of data, not its integrity or availability.

• CVE-2026-28511MEDIUM 4.3

  eLabFTW, an open-source electronic lab notebook platform, contains an information disclosure vulnerability affecting versions before 5.4.2. When an authenticated user performs a numeric search or reference lookup, the system may return resource titles that the user should not have access to view. The actual content of those resources remains protected—only the titles are exposed. This is particularly concerning because titles may contain sensitive information such as project names, patient identifiers, or regulated data that could constitute unauthorized disclosure.

• CVE-2026-3433MEDIUM 4.3

  Mattermost's websocket service inadvertently broadcasts permission change notifications to all authenticated users, including guest-level accounts, even when those users lack membership in the affected team or channel. An attacker with guest credentials can observe role and permission updates for private teams they should have no visibility into, revealing information about organizational access controls. This is a confidentiality issue requiring authentication to exploit but affecting teams that rely on Mattermost's role-based access controls to maintain information barriers between guest and member populations.

• CVE-2026-36602MEDIUM 4.3

  A Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909 has a flaw in its UPnP service that exposes internal kernel memory addresses to anyone on the same network segment. An attacker can query the router's UPnP interface to extract a raw MIPS kernel pointer, effectively creating a roadmap of how the router's operating system is laid out in memory. While this doesn't directly compromise the device, it removes a significant barrier to follow-up attacks by revealing memory layout details that are normally hidden.

• CVE-2026-36615MEDIUM 4.3

  The Mercusys AC12G (EU) router running firmware version AC12G(EU)_V1_200909 contains an unauthenticated information disclosure vulnerability. An attacker on the same local network can access a hidden endpoint (/agileconfigreset) that leaks internal buffer contents without requiring any credentials or user interaction. This information could be used to further compromise the device or the network it serves.

• CVE-2026-36618MEDIUM 4.3

  The Mercusys AC12G (EU) router with firmware version AC12G(EU)_V1_200909 has a configuration issue that allows anyone on the local network to discover which version of the DNS resolver software (unbound 1.22.0) is running on the device. An attacker can query the router for this information and use it to identify known vulnerabilities affecting that specific DNS software version, making targeted attacks easier. This is a local network exposure only—an attacker would need network access to the router or its subnet to exploit it.

• CVE-2026-44779MEDIUM 4.3

  Discourse, a popular open-source discussion platform, contains a flaw in bot debug endpoints that unintentionally exposes sensitive whisper translation audit logs. Whispers are private messages intended only for specific users or moderators, and their translation records should not be accessible. Authenticated users can access these debug endpoints and retrieve information about whisper translations that they shouldn't see, potentially revealing private conversations and moderation activities. The vulnerability affects multiple active release branches and has been patched.

• CVE-2026-44780MEDIUM 4.3

  Discourse has a privilege-bypass vulnerability where category moderators can read the full source of emails submitted to the platform, even if they lack explicit permission to view raw email content. When posts arrive via incoming email integration, a serialization component unintentionally exposes complete email headers, metadata, and body to anyone reviewing flagged posts—sidestepping the normal access controls that restrict raw email viewing. This leaks potentially sensitive information embedded in inbound emails to a wider set of moderators than intended.

• CVE-2026-44782MEDIUM 4.3

  Discourse, an open-source discussion platform, contains a logic error in how it handles user name visibility settings. Due to a misnamed predicate in the GroupPostSerializer component, user names are always included in API responses regardless of the site administrator's configuration to disable them. An authenticated user can exploit this to retrieve user name information that should be hidden, even when the 'enable_names' setting is turned off. The issue affects multiple version branches and has been patched.

• CVE-2026-44785MEDIUM 4.3

  Discourse, an open-source discussion platform, contains an authorization flaw in its AI-powered "explain" feature. When a user asks the system to explain a reply to a post, the feature only checks whether the user can see the reply itself—not whether they should have access to the parent post being discussed. This oversight allows any authenticated user with access to the AI helper to read hidden or restricted parent posts by simply requesting an explanation of a public reply to them. The vulnerability affects multiple version branches and has been patched.

• CVE-2026-45286MEDIUM 4.3

  An authenticated user on a Nextcloud instance can discover other users' identities by abusing the Calendar app's attendee-suggestion feature. The vulnerability exists because this endpoint bypasses the access controls that Nextcloud applies elsewhere. An attacker already logged into the system can systematically enumerate valid usernames, potentially laying groundwork for targeted attacks like password spraying or social engineering. The flaw affects Nextcloud versions 5.5.13 through 5.5.16 and 6.2.0 through 6.2.2.

• CVE-2026-47263MEDIUM 4.3

  Discourse versions released between early 2026 and mid-2026 contain an access control flaw in their webhook event redelivery system. When Discourse attempts to resend failed webhook notifications, it broadcasts internal event data to a world-readable channel without properly restricting who can see it. Any logged-in user—or any visitor on instances without login requirements—can discover and read webhook events by guessing sequential webhook IDs. This exposes sensitive data that webhook endpoints are designed to receive privately, such as user activity, content moderation events, or custom application logic tied to your Discourse instance.

• CVE-2026-48891MEDIUM 4.3

  Apache Airflow contains an information disclosure vulnerability in its web UI's dependency graph viewer. Authenticated users with permission to read certain workflows can inadvertently discover the names and identifiers of other workflows they should not have access to by examining trigger and sensor dependency relationships displayed in the graph. This happens because the filtering logic that restricts which workflows a user can see was incompletely applied—it hides the top-level workflow information but still leaks workflow identifiers in the detailed dependency connections. Organizations relying on workflow-level access controls to keep workflow names confidential across teams are at risk.

• CVE-2026-49288MEDIUM 4.3

  Statamic, a Laravel-based content management system, contained an authorization flaw that allowed authenticated users with Control Panel access to view content and metadata they weren't supposed to see. An attacker with valid login credentials could browse restricted entries, assets, user profiles, roles, and groups—exposing titles, custom field values, entry content, asset metadata, and the mere existence of sensitive organizational structures. The vulnerability is read-only; attackers could not modify data. Fixed in Statamic 5.73.23 and 6.20.0.

• CVE-2026-49355MEDIUM 4.3

  OpenProject versions before 17.4.0 contain an information disclosure vulnerability in the meeting agenda API endpoint. An authenticated attacker can view private work package details that are linked to meeting agenda items, even when those work packages belong to projects the attacker cannot normally access. This leaks sensitive project information to users who should not have visibility into it.

• CVE-2026-56298MEDIUM 4.3

  Capgo versions before 12.128.2 do not remove EXIF metadata from images that users upload through the app information endpoint. EXIF data embedded in photos can reveal precise geolocation coordinates, timestamps, device information, and other sensitive details. An authenticated attacker could upload specially crafted images to extract this embedded metadata, potentially learning the physical locations where images were taken or other operational details about the target environment.

• CVE-2026-7526MEDIUM 4.3

  The PDF Embedder plugin for WordPress contains a flaw that allows authenticated users with basic contributor permissions or higher to access sensitive configuration information. If the premium add-on is installed with a saved license key, that key can be exposed; on free installations, the exposure is limited to non-sensitive viewer settings like dimensions and toolbar options. An attacker would need valid WordPress login credentials at the contributor level or above to exploit this, but no user interaction or network complexity is required once authenticated.

• CVE-2026-8995MEDIUM 4.3

  The Poll Maker – Versus Polls plugin for WordPress has a flaw that lets logged-in users see sensitive account information they shouldn't access, including password hashes. The vulnerability stems from an AJAX endpoint that returns the entire WordPress user object without proper security checks. Any subscriber or higher can call this endpoint and retrieve not just their own data, but potentially others' account details including email addresses, registration dates, roles, and capabilities. While the exposure doesn't immediately compromise an account, the password hash data could be targeted by offline cracking attempts.

• CVE-2026-9183MEDIUM 4.3

  The 24liveblog WordPress plugin leaks sensitive API credentials to authenticated users with basic contributor access or higher. When these users open the WordPress block editor, the plugin inadvertently exposes authentication tokens and account identifiers as JavaScript data embedded in the page source. An attacker with even minimal WordPress account privileges can view this sensitive information by inspecting the browser's page source, gaining unauthorized access to the site's 24liveblog integration account.

• CVE-2026-9929MEDIUM 4.3

  A flaw in how Google Chrome on Android handles WebGL—a technology that enables 3D graphics in web browsers—could allow an attacker to trick a user into visiting a malicious webpage and expose data from other websites the user has open. The attacker cannot force this to happen; the user must interact with the page, such as by clicking or scrolling. This is a cross-origin data leak, meaning sensitive information from one domain could become visible to JavaScript code running on an attacker's domain.

• CVE-2026-9955MEDIUM 4.3

  A vulnerability in Google Chrome on iOS versions before 148.0.7778.216 allows attackers to extract sensitive information from websites the user visits. An attacker would craft a malicious webpage and trick a user into visiting it; the page can then read data intended to be private to other websites. This is a cross-origin data leak—a violation of the browser's same-origin policy that normally prevents websites from accessing each other's information.

• CVE-2026-47165MEDIUM 4.1

  ImageMagick, a widely-used open-source image manipulation tool, contained a flaw in how its distributed pixel cache system authenticated connections. The distributed pixel cache feature, which allows ImageMagick instances to share pixel data across systems, did not require proper authentication before versions 6.9.13-48 and 7.1.2-23. An attacker with high privileges on the same system could potentially read sensitive pixel data—such as confidential images being processed—without authorization. This is a local-only issue affecting system administrators and environments where multiple users or services share the same ImageMagick installation.

• CVE-2026-45536MEDIUM 4.0

  Netty, a widely-used Java network framework, has a file descriptor leak in its Unix domain socket implementation when handling multi-fd messages. When a peer sends a crafted control message carrying multiple file descriptors via SCM_RIGHTS, Netty's receiver allocates a fixed buffer that happens to fit the kernel's response exactly. The code then performs a validation check that fails due to the unexpected message format, causing the installed file descriptors to never be closed. Applications using DomainSocketChannel with FILE_DESCRIPTORS read mode—a non-default opt-in feature—can leak two file descriptors per malicious message received from a peer on the same host. This degrades availability by exhausting the process's file descriptor limit.

• CVE-2026-45683LOW 3.8

  OpenTelemetry eBPF Instrumentation versions prior to 0.9.0 contain a memory disclosure vulnerability in the Java TLS monitoring probe. The vulnerability stems from incorrect kernel memory access calls that allow a local attacker to read sensitive kernel memory and exfiltrate it through the instrumentation telemetry pipeline. This is a localized information disclosure risk that requires local process-level access to exploit.

• CVE-2026-46584LOW 3.7

  Apache Camel's mail component has an input validation flaw that allows untrusted data to override email sending configuration. If a Camel route accepts input from external sources (like HTTP requests or message queues) and passes it directly to an SMTP/SMTPS producer without filtering, an attacker can inject malicious mail configuration headers. On older versions (before 4.19.0), this could redirect email traffic to attacker-controlled servers, exposing configured SMTP credentials. On newer versions, the attack is limited to weakening security settings or intercepting message content. The vulnerability only materializes in routes that lack proper input sanitization.

• CVE-2026-9836LOW 3.5

  IBM InfoSphere Information Server versions 11.7.0.0 through 11.7.1.6 contain a vulnerability that allows authenticated users on the same network segment to access sensitive information they should not be able to view. The flaw requires an attacker to already have valid credentials and local network access, making opportunistic exploitation unlikely. This is a low-severity disclosure issue rather than a critical system compromise vector.

• CVE-2026-11459LOW 3.3

  SecureAge CatchPulse versions up to 10.9.3 contain a vulnerability in the saappctl.sys driver that can leak sensitive information to authenticated local users. An attacker with a valid local account on the affected system can trigger the IOCTL handler to access data they shouldn't normally see. The vulnerability has been publicly disclosed and active exploitation is possible, though it requires legitimate access to the target machine.

• CVE-2026-45277LOW 3.3

  Nextcloud's approval workflow feature contains an information disclosure flaw that allows authenticated users to determine whether arbitrary files are connected to specific approval processes. An attacker with valid credentials can probe the system to learn if particular files have approval workflows attached, potentially revealing organizational file structures and approval dependencies that should remain confidential. The issue affects versions prior to 2.7.2 and does not require user interaction to exploit.

• CVE-2026-46815LOW 3.2

  CVE-2026-46815 is a low-severity information disclosure flaw in Oracle VM VirtualBox 7.2.8 affecting the VMSVGA graphics device driver. A high-privilege user already logged into a system running VirtualBox can read a limited subset of VirtualBox data that should not be accessible to them. The vulnerability does not enable attackers to modify data, crash the application, or gain system-level control. Its scope extends beyond VirtualBox itself—successful exploitation could indirectly expose data relevant to other products running on or managed by the affected host.

• CVE-2026-46816LOW 3.2

  CVE-2026-46816 is a low-severity information disclosure vulnerability affecting Oracle VM VirtualBox 7.2.8. A high-privileged user already logged into the host system running VirtualBox can read a limited subset of data accessible to VirtualBox. The attack requires existing local access with administrative-level privileges and occurs through the VMSVGA device component. Because VirtualBox often runs on infrastructure managing multiple virtual machines, successful exploitation could expose sensitive data across guest systems, though the scope of readable data is restricted.

• CVE-2026-46874LOW 3.2

  Oracle VM VirtualBox version 7.2.8 contains a privilege escalation vulnerability affecting the Core component. An attacker with high-level privileges and local access to the system running VirtualBox can read sensitive data that VirtualBox manages or processes. While the vulnerability itself resides in VirtualBox, successful exploitation could expose information relevant to other systems or virtual machines it hosts, expanding the security footprint beyond VirtualBox alone. The vulnerability requires the attacker to already have administrative or high-privilege access to the infrastructure, which significantly limits the practical attack surface in most environments.

• CVE-2026-46977LOW 3.2

  A vulnerability in Oracle VM VirtualBox's VMSVGA device component could allow a high-privileged user already logged into the host system to read a limited subset of sensitive data stored within VirtualBox. Version 7.2.8 is affected. The issue is classified as low-severity because successful exploitation requires administrative-level access to the infrastructure where VirtualBox runs, and the data exposure is partial rather than complete. The scope impacts extend beyond VirtualBox itself, meaning the unauthorized read could potentially affect other systems or data managed through the hypervisor.

• CVE-2026-49356LOW 3.2

  Babel, a widely used JavaScript compiler, contains a vulnerability that allows attackers to read arbitrary source map files from systems running the compiler. If an attacker can control the JavaScript code being compiled and see the compiler's output, they can craft malicious code containing a sourceMappingURL comment that tricks Babel into exposing source map files they know the path to. This is a low-severity issue because it requires multiple preconditions: the attacker must have input control, output visibility, and knowledge of the exact file path of the target source map.

• CVE-2026-10011LOW 3.1

  A flaw in Chrome's Skia graphics library could allow an attacker who has already compromised Chrome's renderer process to extract sensitive data from websites you visit. The attacker would need to serve you a specially crafted web page to perform the attack. While the underlying issue received a High severity rating from Chromium, the overall exploitability is limited because it requires both renderer compromise and user interaction, making it a low-risk vulnerability in practical terms.

• CVE-2026-11464LOW 3.1

  JeecgBoot versions up to 3.9.2 contain a vulnerability in the User List Endpoint that allows authenticated users to disclose sensitive information by manipulating a salt parameter. An attacker with valid credentials can exploit this flaw to access restricted data, though doing so requires specific conditions and technical knowledge. A fix is planned for a future release.

• CVE-2026-45739LOW 3.1

  Strawberry GraphQL, a popular library for building GraphQL APIs, has a flaw in its bundled GraphiQL interface (versions 0.288.4 through 0.315.3) where sensitive headers entered by developers are inadvertently exposed in the browser URL. When a developer pastes an authorization token or other credential into the GraphiQL headers editor, that value becomes part of the page URL and persists in browser history, shareable links, and server access logs. This creates a credential leakage risk if someone gains access to those logs or if links are shared. The issue has been patched in version 0.315.4.

• CVE-2026-9991LOW 3.1

  A vulnerability in Google Chrome's media handling on Windows allows an attacker who has already compromised the browser's renderer process to extract sensitive data across security boundaries. The attacker would need to host a malicious webpage and trick a user into visiting it while the renderer is already under their control. The exposure is information disclosure—no system takeover or crashes—and the barrier to exploitation is relatively high because the attacker must first achieve renderer compromise.