Total
410 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-57736 | 2026-07-01 | N/A | 7.4 HIGH | ||
| Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: from n/a through 11.3.51. | |||||
| CVE-2026-27868 | 2026-07-01 | N/A | N/A | ||
| An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerable software could obtain privilege information by using the command Version via the path: /upgrade/query.php?cmd=p+3&3Bversion resulting in a information disclosure. This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.05.10.02. | |||||
| CVE-2026-55180 | 1 Pnpm | 1 Pnpm | 2026-06-29 | N/A | 6.5 MEDIUM |
| pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml into registry request destinations and registry credentials. A malicious repository could cause dependency resolution to send victim environment secrets to an attacker-selected registry before lifecycle scripts run. This vulnerability is fixed in 10.34.2 and 11.5.3. | |||||
| CVE-2025-31978 | 1 Hcltech | 1 Bigfix Service Management | 2026-06-29 | N/A | 4.6 MEDIUM |
| HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content. | |||||
| CVE-2026-57318 | 2026-06-26 | N/A | 6.5 MEDIUM | ||
| Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions. | |||||
| CVE-2026-54834 | 2026-06-26 | N/A | 7.5 HIGH | ||
| Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions. | |||||
| CVE-2026-54821 | 2026-06-26 | N/A | 7.4 HIGH | ||
| Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions. | |||||
| CVE-2026-54841 | 2026-06-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions. | |||||
| CVE-2026-54848 | 2026-06-25 | N/A | 8.3 HIGH | ||
| Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3. | |||||
| CVE-2026-22551 | 1 Eclipse | 1 Theia | 2026-06-22 | N/A | 6.5 MEDIUM |
| In Eclipse Theia versions prior to 1.71.0, the AI chat rendered Markdown image tags from AI responses, triggering HTTP requests to arbitrary external URLs without restriction. Combined with prompt injection in a malicious workspace, an attacker could induce the AI agent to construct image URLs encoding sensitive information from the workspace or conversation context, exfiltrating it to attacker-controlled servers. The workspace trust enforcement introduced in v1.71.0 mitigates the documented attack chain by disabling AI features in untrusted workspaces. | |||||
| CVE-2026-7184 | 1 Mattermost | 1 Mattermost Server | 2026-06-18 | N/A | 6.5 MEDIUM |
| Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the {{manage_secure_connections}} permission to obtain remote cluster authentication tokens via a PATCH request to the remote cluster endpoint.. Mattermost Advisory ID: MMSA-2026-00662 | |||||
| CVE-2026-34888 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Unauthenticated Sensitive Data Exposure in Bricksforge <= 3.1.8.4 versions. | |||||
| CVE-2026-52698 | 2026-06-17 | N/A | 7.4 HIGH | ||
| Subscriber Sensitive Data Exposure in PushEngage – Web Push Notifications, eCommerce Automation & Chat Widget <= 4.2.3 versions. | |||||
| CVE-2024-35690 | 2026-06-17 | N/A | 6.5 MEDIUM | ||
| Insertion of sensitive information into sent data vulnerability in MarketingFire Widget Options allows Retrieve Embedded Sensitive Data. This issue affects Widget Options: from n/a through 4.0.1. | |||||
| CVE-2026-5512 | 1 Github | 1 Enterprise Server | 2026-06-17 | N/A | 4.3 MEDIUM |
| An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to determine the names of private repositories by their numeric ID. The mobile upload policy API endpoint did not perform an early authorization check, and validation error messages included the full repository name for repositories the caller did not have access to. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.21 and was fixed in versions 3.20.1, 3.19.5, 3.18.8, 3.17.14, 3.16.17, 3.15.21, and 3.14.26. This vulnerability was reported via the GitHub Bug Bounty program. | |||||
| CVE-2026-54197 | 2026-06-17 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions. | |||||
| CVE-2026-52695 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions. | |||||
| CVE-2026-52692 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions. | |||||
| CVE-2026-4927 | 1 Devolutions | 1 Devolutions Server | 2026-06-17 | N/A | 6.5 MEDIUM |
| Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11. | |||||
| CVE-2026-49082 | 2026-06-17 | N/A | 7.4 HIGH | ||
| Subscriber Sensitive Data Exposure in Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 versions. | |||||