Total
216 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-10450 | 1 Rti | 1 Connext Professional | 2026-09-22 | N/A | 7.5 HIGH |
| Exposure of Private Personal Information to an Unauthorized Actor vulnerability in RTI Connext Professional (Core Libraries) allows Sniffing Network Traffic. This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.2.0 before 7.3.1. | |||||
| CVE-2026-88875 | 2026-09-18 | N/A | 4.3 MEDIUM | ||
| AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API secret; it never compares User::getId() with the row's users_id. As a result, any low-privilege authenticated account can request another user's video and receive the owner's email address, account name (user), and isAdmin, canUpload and canStream flags, which are removed for guests and should be returned only to the owner or to callers with a valid API secret. No patched version was available at the time of the advisory. | |||||
| CVE-2026-28836 | 1 Apple | 1 Macos | 2026-09-18 | N/A | 6.1 MEDIUM |
| A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8.8. An attacker with physical access may be able to silently persist an Apple Account on an erased device. | |||||
| CVE-2026-28938 | 1 Apple | 2 Ipados, Iphone Os | 2026-09-17 | N/A | 7.5 HIGH |
| A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to fingerprint the user. | |||||
| CVE-2026-84606 | 1 Apple | 4 Ipados, Iphone Os, Macos and 1 more | 2026-09-17 | N/A | 7.5 HIGH |
| A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to identify a user across reinstalls. | |||||
| CVE-2026-76855 | 2026-09-16 | N/A | 6.5 MEDIUM | ||
| Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and mod_dispatch_auth/plan.json. Attackers can query these audit components to obtain other users' session and browsing history data across sessions. | |||||
| CVE-2026-86904 | 1 Apple | 3 Ipados, Iphone Os, Watchos | 2026-09-16 | N/A | 7.5 HIGH |
| A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to track users across apps and websites without permission. | |||||
| CVE-2026-73008 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-10 | N/A | 5.5 MEDIUM |
| Exposure of private personal information to an unauthorized actor in Windows Biometric Service allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-55496 | 2026-09-08 | N/A | 4.3 MEDIUM | ||
| Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addresses and profile metadata for inactive or banned accounts. The service calls userClient.SearchActive, but despite its name that method filters only by email/nickname keyword and never adds a StatusActive predicate — while the sibling lookups GetActiveByID and GetActiveByDavAccount, defined a few lines above it, do. Search hits are serialized at RedactLevelUser, which includes the email address. This issue is fixed in version 4.17.0. | |||||
| CVE-2026-21827 | 2026-09-03 | N/A | 3.1 LOW | ||
| HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handling of request data. | |||||
| CVE-2026-58510 | 2026-08-26 | N/A | 4.3 MEDIUM | ||
| GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private | |||||
| CVE-2026-74966 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-25 | N/A | 7.5 HIGH |
| Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2019-25762 | 1 Joomboost | 1 Joomproject | 2026-08-21 | N/A | 7.5 HIGH |
| Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by exploiting the projects endpoint. Attackers can send requests to index.php with option=com_jpprojects&view=projects&tmpl=component&format=json parameters to retrieve user IDs, names, and email addresses in JSON format. | |||||
| CVE-2024-26192 | 1 Microsoft | 1 Edge Chromium | 2026-08-10 | N/A | 8.2 HIGH |
| Microsoft Edge (Chromium-based) Information Disclosure Vulnerability | |||||
| CVE-2026-20834 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-07-30 | N/A | 4.6 MEDIUM |
| Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack. | |||||
| CVE-2025-13477 | 2026-07-23 | N/A | 7.1 HIGH | ||
| Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiBurada allows Authentication Bypass. This issue affects WifiBurada: through 21052026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-26237 | 1 Qnap | 1 Qumagie | 2026-07-23 | N/A | 7.5 HIGH |
| A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions. We have already fixed the vulnerability in the following version: QuMagie 2.9.0 and later | |||||
| CVE-2026-25699 | 1 Apache | 1 Answer | 2026-07-23 | N/A | 6.1 MEDIUM |
| Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Timeline-related APIs lacked proper authorization checks, allowing regular authenticated users to access deleted, private, or unapproved content and its revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue. | |||||
| CVE-2026-56171 | 1 Microsoft | 2 Remote Desktop Web Client, Windows Admin Center | 2026-07-22 | N/A | 7.1 HIGH |
| Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-54264 | 1 Angular | 1 Angular | 2026-07-09 | N/A | 6.1 MEDIUM |
| Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials (e.g., Authorization tokens, Proxy-Authorization credentials, or session cookies) by triggering a cross-origin redirect to an untrusted external origin. This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25. | |||||