medium · CVSS v3 5.3 · CVSS v4 6.9

CVE-2026-122154

A remote information disclosure flaw exists in purocean Yank Note 3.93.0 within the Settings Endpoint’s config.getAll function. The flaw all

Overview

A remote information disclosure flaw exists in purocean Yank Note 3.93.0 within the Settings Endpoint’s config.getAll function. The flaw allows attackers to retrieve sensitive configuration data. Upgrading to 3.93.1 removes the exposed key from responses.

Description

A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.93.1 will fix this issue. The patch is identified as 59f85d48f17a70a402ad59dcecacdbec20f954df. The affected component should be upgraded. The commit removes the key from the response.

Impact

The vulnerability compromises confidentiality by exposing configuration details that could aid further attacks. It affects all users and administrators of the affected version, potentially revealing sensitive system settings.

Remediation

Apply the official patch by upgrading to version 3.93.1 or applying the commit 59f85d48f17a70a402ad59dcecacdbec20f954df. Verify that the Settings Endpoint no longer returns the sensitive key and restrict access to the endpoint as needed.

Risk context

The CVSS v3 score is 5.3 and v4 is 6.9, indicating a medium severity. No EPSS data is available, but the public exploit means the issue should be addressed promptly.

Affected products

  • purocean Yank Note

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
6.9
EPSS
—

information-disclosure remote medium purocean YankNote config endpoint

← All CVEs

Related CVEs

medium

CVE-2026-122049

A flaw has been found in Campcodes Bitcoin Wallet System 1.0. This affects the function random_int of the file core/app/Http/Controllers/Auth/ForgotPasswordController.php. This manipulation causes improper restriction of excessive authentication attempts. Remote exploitation of the attack is possible. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used.

View analysis

medium

CVE-2026-105971

The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.

View analysis

medium

CVE-2026-90963

The Essential Real Estate WordPress plugin (v<5.3.5) lacks authorization checks on an AJAX action, enabling unauthenticated users to retrieve full details of unpublished property listings, including agent contact information. This flaw exposes sensitive data that should remain private. The vulnerability is medium severity (CVSS 5.3).

View analysis

medium

CVE-2026-122052

A vulnerability has been found in laspy up to 2.7.0. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontrolled memory allocation. Remote exploitation of the attack is possible.

View analysis