Catalog

Findings

Filter the merged record by severity, source, stack, and weakness type.

SearchSeveritySourceStackWeaknessSort

Known exploited only

Reset

Medium5.3Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability.CVE-2026-110466 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%Oct 14, 2026
Medium6.5Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.CVE-2026-97740 · microsoft · 365 apps · CVE.org · FIRST EPSS · NIST NVD · Microsoft, Microsoft 365EPSS 0.8%Oct 13, 2026
Medium5.3The OTRS Agent Frontend configuration endpoint can be accessed without authentication.CVE-2026-78356 · CVE.org · NIST NVDOct 12, 2026
Medium6.5IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.CVE-2025-33141 · CVE.org · FIRST EPSS · NIST NVD · IBMEPSS 0.3%Sep 18, 2026
Medium6.9The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthentica…CVE-2026-75928 · CVE.org · NIST NVDAug 21, 2026
Medium4.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPFunnels Team Mail Mint allows Retrieve Embedded Sensitive Data.CVE-2026-27349 · CVE.org · NIST NVDMay 21, 2026
Medium4.5An information disclosure vulnerability in Trust Protection Foundation enables an authenticated attacker to obtain sensitive information from the server's vault.CVE-2026-0240 · paloaltonetworks · trust protection foundation · CVE.org · NIST NVDMay 13, 2026
Medium4.9An information disclosure vulnerability in the Chronosphere Chronocollector enables an unauthenticated attacker with network access to the collector service to retriev…CVE-2026-0239 · paloaltonetworks · chronosphere collector · CVE.org · NIST NVDMay 13, 2026
High7.5The issue was addressed with improved memory handling.CVE-2026-43654 · apple · ipados · CVE.org · NIST NVD · Apple, iOSMay 11, 2026
Medium6.9SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the new GINA UI, allowing remote attack…CVE-2026-7864 · CVE.org · NIST NVDMay 8, 2026
Medium6.9Vvveb before 1.0.8.2 contains an information disclosure vulnerability in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key.CVE-2026-41928 · CVE.org · NIST NVDMay 7, 2026
High8.6Inngest is a platform for running event-driven and scheduled background functions with queueing, retries, and step orchestration.CVE-2026-42047 · inngest · inngest · CVE.org · NIST NVDMay 7, 2026
Medium5.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs Happy Addons for Elementor allows Retrieve Embedded Sensitive Data.CVE-2026-25468 · CVE.org · NIST NVDMay 7, 2026
Medium5.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper BetterDocs betterdocs allows Retrieve Embedded Sensitive Data.T…CVE-2026-42644 · CVE.org · NIST NVDApr 29, 2026
High8.6NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by sending pr…CVE-2026-24222 · nvidia · nemoclaw · CVE.org · NIST NVDApr 28, 2026
Medium5.3OpenClaw before 2026.4.2 exposes configPath and stateDir metadata in Gateway connect success snapshots to non-admin authenticated clients.CVE-2026-41339 · openclaw · openclaw · CVE.org · NIST NVDApr 23, 2026
Medium6.9OpenClaw before 2026.3.31 contains an information disclosure vulnerability in the Control Interface bootstrap JSON that exposes version and assistant agent identifiers.CVE-2026-41335 · openclaw · openclaw · CVE.org · NIST NVDApr 23, 2026
Medium6.9Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side…CVE-2026-41459 · CVE.org · NIST NVDApr 22, 2026
High8.8Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php…CVE-2026-34413 · CVE.org · NIST NVDApr 22, 2026
Critical9.3Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sparx…CVE-2025-15623 · sparxsystems · pro cloud server · CVE.org · NIST NVDApr 17, 2026
Medium5.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Retrieve Embedded Sensitiv…CVE-2026-39686 · CVE.org · NIST NVDApr 8, 2026
Medium4.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-…CVE-2026-39572 · CVE.org · NIST NVDApr 8, 2026
Medium5.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themefic Instantio instantio allows Retrieve Embedded Sensitive Data.This i…CVE-2026-39571 · CVE.org · NIST NVDApr 8, 2026
Medium4.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Designinvento DirectoryPress directorypress allows Retrieve Embedded Sensit…CVE-2026-39566 · CVE.org · NIST NVDApr 8, 2026
Medium5.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Chill RSVP and Event Management rsvp allows Retrieve Embedded Sensitive…CVE-2026-39536 · CVE.org · NIST NVDApr 8, 2026