Total
11775 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-79817 | 2026-10-07 | N/A | 5.5 MEDIUM | ||
| A sensitive information disclosure vulnerability exists in the client software of HPE Networking ClearPass Policy Manager. Successful exploitation could allow an attacker with local access to the affected system to obtain sensitive information. | |||||
| CVE-2022-0235 | 3 Debian, Node-fetch Project, Siemens | 3 Debian Linux, Node-fetch, Sinec Ins | 2026-10-07 | 5.8 MEDIUM | 6.1 MEDIUM |
| node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor | |||||
| CVE-2021-34485 | 1 Microsoft | 5 .net, .net Core, Powershell Core and 2 more | 2026-10-07 | 2.1 LOW | 5.0 MEDIUM |
| .NET Core and Visual Studio Information Disclosure Vulnerability | |||||
| CVE-2026-96530 | 2026-10-07 | N/A | 6.5 MEDIUM | ||
| The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials. | |||||
| CVE-2026-97331 | 2026-10-07 | N/A | 4.3 MEDIUM | ||
| The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators. | |||||
| CVE-2026-103378 | 2026-10-07 | N/A | 6.5 MEDIUM | ||
| The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attackers to retrieve the key and use it to modify WooCommerce order statuses. The same log file also exposes customer information from orders the shop has processed. | |||||
| CVE-2026-86816 | 2026-10-07 | N/A | 5.3 MEDIUM | ||
| The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind authentication. | |||||
| CVE-2026-106277 | 1 Google | 1 Chrome | 2026-10-07 | N/A | 4.3 MEDIUM |
| Information leak in Animation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-106330 | 1 Google | 1 Chrome | 2026-10-07 | N/A | 4.3 MEDIUM |
| Information leak in Paint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-106392 | 1 Google | 1 Chrome | 2026-10-07 | N/A | 4.3 MEDIUM |
| Information leak in WebAudio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-106321 | 1 Google | 1 Chrome | 2026-10-07 | N/A | 4.3 MEDIUM |
| Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-106254 | 1 Google | 2 Android, Chrome | 2026-10-07 | N/A | 5.1 MEDIUM |
| Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: Medium) | |||||
| CVE-2026-106256 | 1 Google | 2 Android, Chrome | 2026-10-07 | N/A | 8.8 HIGH |
| Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-106415 | 1 Google | 1 Chrome | 2026-10-07 | N/A | 4.3 MEDIUM |
| Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2025-15082 | 1 Gztozed | 2 Zlt M30s, Zlt M30s Firmware | 2026-10-07 | 5.0 MEDIUM | 5.3 MEDIUM |
| A vulnerability was found in TOZED ZLT M30s up to 1.47. Impacted is an unknown function of the file /reqproc/proc_post of the component Web Management Interface. Performing manipulation of the argument goformId results in information disclosure. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-15065 | 2026-10-07 | N/A | 6.3 MEDIUM | ||
| Exposure of Sensitive Information to an Unauthorized Actor, Missing Encryption of Sensitive Data, Files or Directories Accessible to External Parties vulnerability in Kings Information & Network Co. KESS Enterprise on Windows allows Privilege Escalation, Modify Existing Service, Modify Shared File.This issue affects KESS Enterprise: before *.25.9.19.exe | |||||
| CVE-2025-15103 | 1 Deltaww | 2 Dvp-12se11t, Dvp-12se11t Firmware | 2026-10-07 | N/A | 8.1 HIGH |
| DVP-12SE11T - Authentication Bypass via Partial Password Disclosure | |||||
| CVE-2025-14280 | 2026-10-07 | N/A | 5.3 MEDIUM | ||
| The PixelYourSite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.1.5 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files, when the "Meta API logs" setting is enabled (disabled by default). The vulnerability was partially patched in version 11.1.5 and fully patched in version 11.1.5.1. | |||||
| CVE-2025-15070 | 1 Gmission | 1 Web Fax | 2026-10-07 | N/A | 5.5 MEDIUM |
| Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse. This issue affects Web Fax: from 3.0 before 3.0.1 | |||||
| CVE-2025-68273 | 1 Signalk | 1 Signal K Server | 2026-10-07 | N/A | 5.3 MEDIUM |
| Signal K Server is a server application that runs on a central hub in a boat. An unauthenticated information disclosure vulnerability in versions prior to 2.19.0 allows any user to retrieve sensitive system information, including the full SignalK data schema, connected serial devices, and installed analyzer tools. This exposure facilitates reconnaissance for further attacks. Version 2.19.0 patches the issue. | |||||