Total
444 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-42047 | 1 Inngest | 1 Inngest | 2026-10-26 | N/A | 8.6 HIGH |
| Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orchestration. Versions 3.22.0 through 3.53.1 contain a vulnerability that allows unauthenticated remote attackers to exfiltrate environment variables from the host process via the serve() HTTP handler. The serve() handler implements GET, POST, and PUT methods. Requests using PATCH, OPTIONS, or DELETE fall through to a generic handler that returns diagnostic information. A change introduced in v3.22.0 caused this diagnostic response to include the contents of process.env, exposing any secrets, API keys, or credentials present in the environment. An application is vulnerable if its serve() endpoint is reachable via PATCH, OPTIONS, or DELETE requests, which is common in setups like Next.js Pages Router or Express's app.use(...). Not affected are Next.js App Router handlers that export only GET, POST, and PUT, and applications using the connect worker method. This issue has been fixed in version 3.54.0. To work around this issue if upgrading is not immediately possible, restrict the serve() endpoint at the framework or reverse-proxy layer to accept only GET, POST, and PUT. The Inngest serve() endpoint does not require any other HTTP methods. | |||||
| CVE-2026-42644 | 2026-10-26 | N/A | 5.3 MEDIUM | ||
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper BetterDocs betterdocs allows Retrieve Embedded Sensitive Data.This issue affects BetterDocs: from n/a through <= 4.3.10. | |||||
| CVE-2026-41928 | 2026-10-26 | N/A | 5.3 MEDIUM | ||
| Vvveb before 1.0.8.2 contains an information disclosure vulnerability in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key. Attackers can access the cron controller without authentication and retrieve the exposed secret key from the response, enabling them to trigger scheduled task execution outside of the intended schedule. | |||||
| CVE-2026-7864 | 2026-10-26 | N/A | N/A | ||
| SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the new GINA UI, allowing remote attackers to obtain sensitive system information. | |||||
| CVE-2026-43654 | 1 Apple | 6 Ipados, Iphone Os, Macos and 3 more | 2026-10-26 | N/A | 7.5 HIGH |
| The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. An app may be able to disclose kernel memory. | |||||
| CVE-2026-0240 | 1 Paloaltonetworks | 1 Trust Protection Foundation | 2026-10-26 | N/A | 8.7 HIGH |
| An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault. Successful exploitation of this issue allows the attacker to impersonate any user within the environment and arbitrarily modify configuration settings. | |||||
| CVE-2026-0239 | 1 Paloaltonetworks | 1 Chronosphere Collector | 2026-10-26 | N/A | 6.5 MEDIUM |
| An information disclosure vulnerability in the Chronosphere Chronocollector enables an unauthenticated attacker with network access to the collector service to retrieve sensitive information. | |||||
| CVE-2026-83925 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-10-26 | N/A | 4.7 MEDIUM |
| Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-24618 | 2026-10-26 | N/A | 4.3 MEDIUM | ||
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HashThemes Hash Elements allows Retrieve Embedded Sensitive Data. This issue affects Hash Elements: from n/a through 1.5.4. | |||||
| CVE-2026-52694 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions. | |||||
| CVE-2026-40796 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Sensitive Data Exposure in WPPizza <= 3.19.9 versions. | |||||
| CVE-2026-9307 | 2026-10-25 | N/A | N/A | ||
| A sensitive information disclosure security issue exists within the affected CompactLogix controllers. The controller's web server exposes CIP Connection IDs on the diagnostics webpage, which are accessible to any unauthenticated user on the network. This information can be leveraged by an attacker to construct malicious packets, leading to Denial-of-Service. | |||||
| CVE-2026-48878 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.4.1 versions. | |||||
| CVE-2026-42660 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Subscriber Sensitive Data Exposure in Contest Gallery <= 28.1.7 versions. | |||||
| CVE-2026-34891 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce <= 2.2.5 versions. | |||||
| CVE-2026-49068 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Subscriber Sensitive Data Exposure in Coupon Affiliates <= 7.8.1 versions. | |||||
| CVE-2026-49056 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Sensitive Data Exposure in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.9.4 versions. | |||||
| CVE-2026-49066 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions. | |||||
| CVE-2026-56124 | 2026-10-25 | N/A | 7.5 HIGH | ||
| phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block, exposing uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints. | |||||
| CVE-2026-57753 | 2026-10-25 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Sensitive Data Exposure in Kit (formerly ConvertKit) for WooCommerce <= 2.1.5 versions. | |||||