#Information Disclosure
All CosmicBytez Labs articles tagged #Information Disclosure, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-54472: Hard-Coded Credentials in Dell CSM Docs Component Expose Sensitive Data
A hard-coded credential in Dell Container Storage Modules' csm-docs component lets unauthenticated attackers read sensitive data.
- Security
CVE-2026-92536: ProfilePress WordPress Plugin Exposes User Data via Shortcode Injection
ProfilePress WordPress plugin versions ≤4.17.4 leak user emails, usernames, and registration dates via shortcode injection (CVSS 8.8). Patch to 4.17.5 now.
- Security
Critical Path Traversal in Super Forms WordPress Plugin Exposes wp-config.php
A CVSS 9.1 unauthenticated path traversal flaw in the Super Forms WordPress plugin (≤ 6.3.316) lets attackers read wp-config.php and other sensitive files.
- Security
Contrast Initializer Leaks Workload Secret to stdout (CVE-2025-71423)
A regression in Edgeless Systems Contrast logs the full NewMeshCert response, including the workload secret, to stdout at INFO level.
- Security
Contrast Initializer Leaks Workload Secret to stderr (CVE-2025-71425)
Edgeless Systems Contrast before 1.8.1 logs the workload secret to stderr at the default log level, exposing it via Kubernetes logs.
- Security
CVE-2026-73600: Dell PowerProtect Data Manager Stack Buffer Overflow
A stack buffer overflow in Dell PowerProtect Data Manager's file-level restore agent lets a high-privileged attacker trigger information disclosure.
- Security
CVE-2026-78122: docker-socket-proxy Fails to Gate Container Read Endpoints
docker-socket-proxy's CONTAINERS guard bypassed via GET requests to /archive, /export, /logs, and /top, exposing arbitrary file reads.
- Security
CVE-2026-74799: SiYuan pprof Debug Endpoints Exposed Without Authentication
SiYuan before 3.7.4 exposes Go pprof debug endpoints unauthenticated, leaking in-memory secrets including API keys and auth codes.
- Security
CVE-2026-57989: Microsoft Edge Origin Validation Error Allows Remote Information Disclosure
A high-severity origin validation error in Microsoft Edge (Chromium-based) enables an unauthenticated remote attacker to disclose sensitive information...
- Security
CVE-2026-57990: Microsoft Edge Exposes Local Files and Directories to Remote Attackers
A high-severity access control flaw in Microsoft Edge (Chromium-based) allows unauthenticated remote attackers to access files or directories that should...
- Security
CVE-2026-49191: M3WebServer Hard-Coded API Keys Exposed via Error Pages
A critical CVSS 9.8 vulnerability in M3WebServer hard-codes backend API keys in the production build. Attackers intercept them through verbose error handling…
- Security
CVE-2026-39079: PrestaShop UPS Shipping Module Sensitive
CVE-2026-39079 is a CVSS 7.5 (High) information disclosure vulnerability in the PrestaShop upsshipping module affecting all versions through 2.4.0. Remote...
- Security
CVE-2026-8043: Ivanti Xtraction File Control & HTML
A critical vulnerability in Ivanti Xtraction before version 2026.2 allows remote authenticated attackers to read sensitive files and write arbitrary HTML...
- Security
CVE-2026-5128: Steam Trader 2.1.1 Unauthenticated Sensitive
A CVSS 10.0 critical vulnerability in steam-trader 2.1.1 exposes Steam account credentials, identity secrets, and shared secrets to unauthenticated remote...
- Security
CVE-2026-33669: SiYuan Unauthenticated Document Content
A critical unauthenticated information disclosure vulnerability in SiYuan, the personal knowledge management system, allows remote attackers to retrieve...
- Security
CVE-2016-20030: ZKTeco ZKBioSecurity 3.0 Username
ZKTeco ZKBioSecurity 3.0 allows unauthenticated attackers to enumerate valid usernames by submitting partial character strings to the...
- Security
CVE-2025-47813: Wing FTP Server Path Disclosure Enables RCE
CISA has added CVE-2025-47813, a medium-severity information disclosure flaw in Wing FTP Server, to its KEV catalog after confirming active exploitation...