This page collects WhisperX intelligence signals tagged #Data Exposure. It is designed for humans, search engines, and AI agents: each item links to a canonical source-backed record with sector, source, timestamp, credibility, and exportable structured data.
A critical security flaw in the popular Animal Sounds and Ringtones app allows attackers to overwrite any file within the app's internal storage, creating a direct path to potential code execution and data theft. The vulnerability, found in version V1.3.0 of the app published by PEAKSEL D.O.O. NIS, stems from a complet...
A medium-severity vulnerability in the popular Node.js logging library, log4js-node, leaves sensitive application data exposed by default. The flaw, tracked as CVE-2022-21704, causes log files created by the library's core appenders to be set with world-readable permissions on Unix-like systems. This means any user or ...
A critical security vulnerability has been identified in the PPOM for WooCommerce plugin, exposing sensitive store data to unauthenticated users. The plugin's entire REST API, comprising seven distinct endpoints, is configured with a blanket `'permission_callback' => '__return_true'`. This configuration effectively byp...
A significant security misconfiguration in an open-source AI platform's API is exposing the full system prompt to clients, creating a direct vector for targeted attacks. The vulnerability, rated as medium severity, resides in the `/api/converse` endpoint, which returns the complete `systemPrompt` field to users upon in...
A critical infrastructure misconfiguration has left a core InRiver development server publicly accessible on the internet, exposing an unauthenticated endpoint capable of executing SQL queries and retrieving database schemas. The MCP Tools Container App, intended to be an internal service, is responding to public reque...
A critical security vulnerability in the Vite build tool has been patched, exposing sensitive server files to the browser. The flaw, tracked as CVE-2026-39364, allows the contents of files explicitly blocked by the `server.fs.deny` configuration to be returned to a user's browser, bypassing intended access controls. Th...
A critical oversight from a recent GitHub audit has left internal Azure subscription IDs and tenant details exposed in a public-facing deployment guide. The issue, originating from PR #408, was merged without review on April 17, 2026, as part of a broader audit (#405). The documentation for the project's 'getting-start...
Google Cloud 的核心人工智能平台 Vertex AI 被曝存在一个安全漏洞，其 Vertex AI Experiments 功能中的存储桶命名模式可被预测。该漏洞被追踪为 CVE-2026-2473，影响 Google Cloud Platform 上从 1.21.0 版本开始，直至（但不包括）1.133.0 版本的所有 `google-cloud-aiplatform` SDK。这意味着在近一年半的版本迭代中，使用 Vertex AI Experiments 功能的项目可能面临数据暴露或未授权访问的风险。 该漏洞源于 Vertex AI Experiments 组件中用于存储实验数据的 Google Cloud St...
A high-severity security vulnerability in a GitHub repository allows any authenticated user to bypass a client-side admin check and directly query the database for all soft-deleted team documents. The flaw, identified in a pre-PR scan for TD #525, stems from a critical mismatch between a frontend JavaScript guard and t...
Vercel has confirmed that its investigation into a security incident first disclosed in April 2026 has uncovered evidence of a second, separate compromise that exposed additional customer data. The expanded probe, described in updated public disclosures and incident-response statements, indicates the breach's scope ext...
A European celebrity's personal data, including years of location history, messages, and photos, was publicly accessible online after being compiled through stalkerware—until a security researcher identified and reported the exposure. The incident represents the type of catastrophic privacy failure that cybersecurity e...
A security demonstration turned into a real-world attack when a hacker remotely commandeered a Yarbo robot lawn mower and ran over a journalist, exposing critical vulnerabilities in thousands of the Chinese-made devices. The incident revealed that Yarbo's bladed robots could be hijacked with minimal effort, potentially...
Enterprise security programs were built to protect servers, endpoints, and cloud accounts—not customer intake forms that product managers "vibe coded" over a weekend using AI tools, connected to live databases, and deployed on public URLs indexed by Google. That architectural blind spot now has a quantified price tag, ...
A high-severity vulnerability in Spring AI's chat memory component has been identified, carrying a CVSS score of 7.5. The flaw stems from a problematic default configuration that, when left unaddressed by developers, can expose conversation data between different users. This represents a classic case of secure-by-defau...