CVE-2026-126264

SiYuan before 3.8.9 Sensitive File Disclosure via /api/file/getFile

SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets.

CVSS 4.0 · 8.3 High EPSS n/a KEV · Not listed

Vendors

B3log

Products

Siyuan

CVE-2026-126266

SiYuan from 3.6.0 before 3.8.9 Publish-Password Bypass via getDoc Regex Keywords

SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

B3log

Products

Siyuan

CVE-2026-126267

NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging

NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding errors in the unawaited logHelper call that terminate the server process.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126288

NocoDB before 2026.06.2 Credential Disclosure via Public OAuth Client Endpoint

NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve full OAuth client records by querying the public client lookup route in oauth.controller.ts. Attackers who know or guess a client identifier can obtain the registration access token to modify or delete registrations, plus the bcrypt client secret hash and owner's internal identifier.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126290

NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read

NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126292

NocoDB before 2026.06.1 Password Hash Exposure via Profile Update Response

NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126308

Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps

The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Coder

Products

Coder

CVE-2026-126392

Parse Server 9.10.6-alpha.1 before 9.10.8-alpha.1 Information Disclosure via Dot Notation Update

Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe internal server errors versus success responses to infer field existence.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed

Vendors

Parseplatform

Products

Parse-server

CVE-2026-121518

Customer Reviews for WooCommerce <= 5.127.0 - Unauthenticated Sensitive Information Exposure in 'search' Parameter

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on wp_ajax_nopriv_* without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into get_comments() as the 'search' argument, which core expands into LIKE conditions over comment_author, comment_author_email, comment_author_url, comment_author_IP and comment_content. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126490

OpenEMR before 8.5.0 Information Disclosure via Debug Code in fax_view.php

OpenEMR before 8.5.0 contains active debug code in interface/fax/fax_view.php that executes passthru("groups") and discloses the web server's Unix group memberships. Authenticated attackers with fax module access can supply a nonexistent jid value to reveal groups such as adm or shadow, aiding privilege escalation planning.

CVSS 4.0 · 2.3 Low EPSS n/a KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126939

Zipline before 4.6.4 Unauthenticated File Listing via page Query Parameter

Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early return and enumerate file names, IDs, MIME types, sizes, and view counts.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126941

Zipline through 4.6.2 Privilege Escalation via Missing Role Checks on User Endpoints

Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take over superadmin accounts, while any authenticated user can enumerate other users' folders via GET /api/user/folders.

CVSS 4.0 · 8.2 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126955

Glance 0.8.0 before 0.8.8 Page Slug Enumeration via Response Discrepancy

Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed

Vendors

Glance Project

Products

Glance

CVE-2026-128019

FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak

FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.

CVSS 4.0 · 6.3 Medium EPSS n/a KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128021

FrankenPHP before 1.13.2 Information Disclosure via libxml Error State in Worker Mode

FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers sending requests to the same worker thread can call libxml_get_errors() or libxml_get_last_error() to obtain other clients' parsed-document fragments and server filesystem paths.

CVSS 4.0 · 6.3 Medium EPSS n/a KEV · Not listed

Vendors

Php

Products

Frankenphp

CVE-2026-128033

OpenMage magento-lts before 20.18.2 Information Disclosure via Order-Status RSS Feed

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage_Rss_Model_Resource_Order::getAllCommentCollection(), which omits the is_visible_on_front filter for invoice, shipment and credit-memo comments. Authenticated customers can open the /rss/order/status feed for their order to read internal staff comments, such as fraud-review and payment notes.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-87801

API Framework Data Exposure in Synology DSM

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Synology

Products

Diskstation Manager

CVE-2026-68512

Paaster: No rate limiting on account login, combined with a public username-enumeration/salt endpoint, enables offline credential-stuffing

Paaster is a pastebin application. Prior to version 3.3.0, Paaster's account login has no rate limiting, lockout, or CAPTCHA of any kind, and a companion endpoint openly discloses whether a username exists along with that account's password-hashing salts. Together these let an attacker enumerate real accounts and then brute-force their passwords with unlimited, unthrottled attempts. This issue has been patched in version 3.3.0.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wardpearce

Products

Paaster

CVE-2026-11732

An insufficient input validation vulnerability exists in the website blocking feature of certain NETGEAR RAX/CAX series models

An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker with access to the local network (such as through Wi-Fi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Netgear

Products

Cax30 Rax30 Rax5 and 1 more

CVE-2026-57500

REVA: Access to internal metadata

REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Opencloud-eu

Products

Reva