Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 235

Export CSV
CVE-2026-28938

User Fingerprinting via Sensitive Data Exposure in iOS/iPadOS 26.6

A privacy issue was addressed by moving sensitive data. This issue is fixed in iOS 26.6 and iPadOS 26.6. An app may be able to fingerprint the user.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ios And Ipados Ipados Iphone Os
CVE-2026-28836

Apple Account Persistence on Erased macOS Devices

A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8.8. An attacker with physical access may be able to silently persist an Apple Account on an erased device.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Macos
CVE-2026-84606

Privacy Violation: Persistent Identifier Tracking Across App Reinstallations

A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to identify a user across reinstalls.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ios And Ipados Ipados Iphone Os and 2 more
CVE-2026-86904

Privacy Issue: Application Track Users Across Apps Without Permission

A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to track users across apps and websites without permission.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ios And Ipados Ipados Iphone Os and 1 more
CVE-2026-61588

djust's Django model serialization has no sensitive-field denylist: password hashes, privilege flags, and PII on a public view attribute are sent to the client

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django `Model` instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as `password` (the hash), privilege flags (e.g. `is_staff` / `is_superuser`), tokens, and other PII to the browser. Because exposing model objects to templates is a normal djust pattern, this could leak credentials/PII without the developer realizing the full object crossed the wire. This is fixed in djust 1.0.7. Model serialization applies a secure-by-default sensitive-field denylist (password/hash/token/secret-style fields and known privilege flags are withheld) with an identity-subset fallback. As a workaround, keep `Model` instances on `_private` attributes and expose only the specific fields needed, until patched.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Djust-org
Products
Djust
CVE-2026-92565

Rallly before 4.15.0 Information Disclosure via polls.get

Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Rallly
Products
Rallly
CVE-2026-88875

AVideo Incomplete API Sanitization Information Disclosure

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API secret; it never compares User::getId() with the row's users_id. As a result, any low-privilege authenticated account can request another user's video and receive the owner's email address, account name (user), and isAdmin, canUpload and canStream flags, which are removed for guests and should be returned only to the owner or to callers with a valid API secret. No patched version was available at the time of the advisory.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wwbn
Products
Avideo
CVE-2026-76855

Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and mod_dispatch_auth/plan.json. Attackers can query these audit components to obtain other users' session and browsing history data across sessions.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Netcore
Products
Nr255-v
CVE-2026-69351

Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability

Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more
CVE-2026-64753

webkitgtk: Processing maliciously crafted web content may disclose sensitive user information

A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may disclose sensitive user information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ios And Ipados Ipados Iphone Os and 5 more
CVE-2026-73008

Windows Biometric Service Information Disclosure Vulnerability

Exposure of private personal information to an unauthorized actor in Windows Biometric Service allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 18 more
CVE-2026-21827

HCL Connections is vulnerable to an information disclosure vulnerability

HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handling of request data.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Connections
CVE-2026-53497

CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)

CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and creation/expiry timestamps. Any unauthenticated network attacker can enumerate this data without credentials. Version 0.9.21 fixes the issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cenodude
Products
Crosswatch
CVE-2026-74966

Information disclosure in the Form Autofill component

Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2019-25762

Joomla! Component JoomProject 1.1.3.2 Information Disclosure

Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by exploiting the projects endpoint. Attackers can send requests to index.php with option=com_jpprojects&view=projects&tmpl=component&format=json parameters to retrieve user IDs, names, and email addresses in JSON format.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Joomboost
Products
Joomproject
CVE-2026-34226

Happy DOM's fetch credentials include uses page-origin cookies instead of target-origin cookies

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Versions prior to 20.8.9 may attach cookies from the current page origin (`window.location`) instead of the request target URL when `fetch(..., { credentials: "include" })` is used. This can leak cookies from origin A to destination B. Version 20.8.9 fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Capricorn86
Products
Happy-dom Happy Dom
CVE-2026-58427

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-58510

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea Open Source Git Server
CVE-2026-48048

XWiki Platform's Livetable results still allow reconstructing password hashes using 768 requests

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page `XWiki.LiveTableResultsMacros`.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Xwiki
Products
Xwiki-platform