Total
444 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-110466 | 2026-10-15 | N/A | 4.3 MEDIUM | ||
| Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information. | |||||
| CVE-2025-67717 | 1 Zitadel | 1 Zitadel | 2026-10-14 | N/A | 4.3 MEDIUM |
| ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users to authenticated users, regardless of their specific permissions. While this does not leak individual user data or PII, disclosing the total user count via the totalResult field constitutes an information disclosure vulnerability that may be sensitive in certain contexts. This issue is fixed in versions 3.4.5 and 4.7.2. | |||||
| CVE-2025-9110 | 1 Qnap | 2 Qts, Quts Hero | 2026-10-14 | N/A | 7.5 HIGH |
| An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later QuTS hero h5.3.1.3250 build 20250912 and later | |||||
| CVE-2025-33141 | 2026-10-14 | N/A | 6.5 MEDIUM | ||
| IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment. | |||||
| CVE-2025-36373 | 1 Ibm | 1 Datapower Gateway | 2026-10-14 | N/A | 4.1 MEDIUM |
| IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0 and IBM DataPower Gateway 10.5.0 10.5.0.0 through 10.5.0.20 and IBM DataPower Gateway 10.6.0 10.6.0.0 through 10.6.0.8 IBM DataPower Gateway could disclose sensitive system information from other domains to an administrative user. | |||||
| CVE-2026-83773 | 2026-10-13 | N/A | 5.5 MEDIUM | ||
| Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-66480 | 2026-10-13 | N/A | 5.3 MEDIUM | ||
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0. | |||||
| CVE-2025-68576 | 2026-10-13 | N/A | 4.3 MEDIUM | ||
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Virusdie Virusdie virusdie allows Retrieve Embedded Sensitive Data.This issue affects Virusdie: from n/a through <= 1.1.6. | |||||
| CVE-2025-68943 | 1 Gitea | 1 Gitea | 2026-10-13 | N/A | 5.3 MEDIUM |
| Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order. | |||||
| CVE-2026-78268 | 2026-10-12 | N/A | 7.5 HIGH | ||
| Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 versions. | |||||
| CVE-2026-81774 | 2026-10-12 | N/A | 7.5 HIGH | ||
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product Attachment woo-product-attachment allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Product Attachment: from n/a through 2.3.4. | |||||
| CVE-2025-59582 | 2026-10-11 | N/A | 5.3 MEDIUM | ||
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Darren Cooney Ajax Load More ajax-load-more allows Retrieve Embedded Sensitive Data.This issue affects Ajax Load More: from n/a through <= 7.6.0.2. | |||||
| CVE-2025-60092 | 2026-10-11 | N/A | 5.3 MEDIUM | ||
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.25. | |||||
| CVE-2026-62036 | 2026-10-11 | N/A | 4.3 MEDIUM | ||
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensitive Data.This issue affects All Bootstrap Blocks: from n/a through 1.3.31. | |||||
| CVE-2025-60167 | 2026-10-09 | N/A | 4.3 MEDIUM | ||
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Page Manager for Elementor: from n/a through <= 2.0.5. | |||||
| CVE-2025-59447 | 2026-10-09 | N/A | 2.2 LOW | ||
| The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentials. | |||||
| CVE-2025-58583 | 1 Sick | 1 Enterprise Analytics | 2026-10-09 | N/A | 5.3 MEDIUM |
| The application provides access to a login protected H2 database for caching purposes. The username is prefilled. | |||||
| CVE-2024-58375 | 2026-10-08 | N/A | 7.5 HIGH | ||
| OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead of producing an error. This is fixed in OpenTofu 1.8.3, which adds explicit errors to prevent the use of sensitive values in these contexts. | |||||
| CVE-2025-44823 | 1 Nagios | 1 Log Server | 2026-10-08 | N/A | 9.9 CRITICAL |
| Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call. This is GL:NLS#475. | |||||
| CVE-2025-52616 | 1 Hcltech | 1 Unica | 2026-10-08 | N/A | 5.3 MEDIUM |
| HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application. | |||||