Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 634

Export CSV
CVE-2026-125777

WordPress Profile Builder plugin <= 4.0.6 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cozmoslabs Wordpress-extensions
Products
Profile Builder Profile Builder
CVE-2026-126308

Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps

The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Coder
Products
Coder
CVE-2026-87801

API Framework Data Exposure in Synology DSM

An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Synology
Products
Diskstation Manager
CVE-2026-126331

Authenticated User Leakage of API Key Secret Hashes via User List API

Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Devolutions
Products
Server
CVE-2026-121674

PowerShell Information Disclosure Vulnerability

Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Powershell Powershell 7.6 Powershell 7.7
CVE-2026-123290

Hidden Notebook Code Exposure via Public Endpoint

In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Datalore
CVE-2026-114183

WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpvibes
Products
Anywhere Elementor Anywhere Elementor
CVE-2026-119499

WordPress FloristPress plugin <= 7.8.4 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Retrieve Embedded Sensitive Data.This issue affects FloristPress: from n/a through 7.8.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Bakkbone Australia Wordpress-extensions
Products
Floristpress Floristpress
CVE-2026-63837

net: ena: PHC: Check return code before setting timestamp output

In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Check return code before setting timestamp output ena_phc_gettimex64() is setting the output parameter regardless of whether ena_com_phc_get_timestamp() succeeded or failed. When ena_com_phc_get_timestamp() returns an error, the timestamp parameter may contain uninitialized stack memory (e.g., when PHC is disabled or in blocked state) or invalid hardware values. Passing these to userspace via the PTP ioctl is both a security issue (information leak) and a correctness bug. Fix by checking the return code after releasing the lock and only setting the output timestamp on success.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-125435

WordPress PowerPack Addons for Elementor plugin <= 3.1.3 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-119465

WordPress Elementor Addon Elements plugin <= 1.15 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through 1.15.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpvibes
Products
Elementor Addon Elements Elementor Addon Elements
CVE-2026-125766

WordPress WPZOOM Social Feed Widget & Block plugin <= 2.4.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allows Retrieve Embedded Sensitive Data.This issue affects WPZOOM Social Feed Widget & Block: from n/a through 2.4.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-125767

WordPress Hubbub Lite plugin <= 1.36.3.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through 1.36.3.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-86505

Missing Project-Trust Check in JetBrains IntelliJ IDEA Leaks Project Metadata

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Intellij Idea
CVE-2025-47541

WordPress Mail Mint plugin <= 1.17.7 - Sensitive Data Exposure Vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Team Mail Mint mail-mint allows Retrieve Embedded Sensitive Data.This issue affects Mail Mint: from n/a through 1.17.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126134

Feed subscriptions could leak NTLM credentials on Windows

Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to that server. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160 and Thunderbird 153.7.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—