The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integratio...

CVE-2026-86834

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root o

历史摘要 · 未重新核验 · NVD

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through th...

CVE-2026-86832

The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthent

历史摘要 · 未重新核验 · NVD

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it writes under the uploads d...

CVE-2026-80518

The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage

历史摘要 · 未重新核验 · NVD

The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin...

CVE-2026-100149

The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive

历史摘要 · 未重新核验 · NVD

WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons <= 4.7.3 - Unauthenticated Sensitive Information Disclosure via HMAC Signature Collision (Missing Domain Sep...

CVE-2026-100149

The WPZOOM Connect: AI Chat, Click to Chat, Social Icons & Share Buttons plugin for WordPress is vulnerable to Sensitive

历史摘要 · 未重新核验 · OSV.dev

Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows...

CVE-2026-105030

Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retri

历史摘要 · 未重新核验 · GitHub Advisory

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows...

CVE-2026-104476

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to ret

历史摘要 · 未重新核验 · GitHub Advisory

Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard...

CVE-2026-105030

Kener 是一款开源的状态页面与监控告警系统。CVE-2026-105030 影响 Kener 4.0.0 及之后、4.1.6 之前的版本。该漏洞存在于 dashboard 相关的 API 处理逻辑中：这些处理器在返回监控项数据时没有应用

历史摘要 · 未重新核验 · NVD

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server af...

CVE-2026-104476

Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to ret

历史摘要 · 未重新核验 · NVD

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

### Summary: 5 findings — unauthenticated full-API exposure (F1, lead Critical), read-side authorization gap that persi

历史摘要 · 未重新核验 · GitHub Advisory

Vibe-Trading file-read tools expose arbitrary server-readable files

### Summary: 2 findings — `safe_user_path()` accepts any path under `Path.home()` or `Path.cwd()`, which inside the shi

历史摘要 · 未重新核验 · GitHub Advisory

Trigger.dev: V1 coordinator default-secret unauth Socket.IO

## TL;DR The /coordinator Socket.IO namespace mounts on every webapp boot and authenticates with a default secret ("coo

历史摘要 · 未重新核验 · GitHub Advisory

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: M...

CVE-2026-103627

Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive informatio

历史摘要 · 未重新核验 · NVD

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content via the recentchangesrssplus RSS actio...

CVE-2026-104455

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restr

历史摘要 · 未重新核验 · NVD

SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn metadata of publish-excluded documents through the getNotebo...

CVE-2026-103763

SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn met

历史摘要 · 未重新核验 · NVD

YesWiki before 4.6.7 Read-ACL Bypass via recentchangesrssplus RSS Action

CVE-2026-104455

YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restr

历史摘要 · 未重新核验 · OSV.dev

SiYuan before v3.8.5 Information Disclosure via /api/notebook/getNotebookInfo

CVE-2026-103763

SiYuan before v3.8.5 contains an information disclosure vulnerability that allows read-only publish readers to learn met

历史摘要 · 未重新核验 · OSV.dev

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl...

CVE-2026-102002

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensi

历史摘要 · 未重新核验 · NVD

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages...

CVE-2026-97317

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from

历史摘要 · 未重新核验 · NVD

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read t...

CVE-2026-90988

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticate

历史摘要 · 未重新核验 · NVD