32332 matches found
CVE-2026-19502 Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...
Insertion of Sensitive Information Into Sent Data
Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the Config API when multi-team mode is enabled and the API is exposed. An attacker can obtain sensitive team-scoped Celery broker credentials by accessing configuration-read endpoints...
CVE-2026-17110 IBM i is Affected By Multiple Vulnerabilities in SQL
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege management...
CVE-2026-17266
IBM i (7.6, 7.5, 7.4, 7.3) is affected by CVE-2026-17266 in Navigator for i, a path traversal flaw that could allow a remote authenticated attacker to obtain sensitive information by improper limitation of a pathname to a restricted directory. CVSS base 6.5 (Network, Low attacker effort, Privileg...
CVE-2026-68970 Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI
Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...
Vulnerabilities in Adobe Commerce
Adobe has identified several vulnerabilities in Adobe Commerce. These vulnerabilities primarily involve incorrect authorization, which allows attackers with varying privilege levels to circumvent security checks. This enables attackers to obtain unauthorized read and write permissions, access...
CVE-2026-16737
The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored...
CVE-2026-16253 Total Upkeep < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...
CVE-2026-16253
The Total Upkeep WordPress plugin (versions before 1.17.3 ) contains a vulnerability where the secret authorizing backup-restore functionality is inadequately protected. This exposure to unauthenticated users allows for the disclosure of sensitive backup information and the ability to force a ful...
CVE-2026-14925 Import WP < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names an...
CVE-2026-14925
The Import WP WordPress plugin, in versions prior to 2.14.23 , is vulnerable to unauthenticated sensitive information exposure due to a lack of authorization checks on an export-file download handler. An unauthenticated attacker could potentially download export files generated by administrators,...
PT-2026-71330
Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description Local attackers can obtain sensitive information because plain text passwords are recorded in trace files. Recommendations At the moment, there is no...
WordPress Custom CSS and JavaScript data leakage vulnerabilities
WordPress Custom CSS and JavaScript allow for the addition of custom styles and interactive scripts through backend or plugins, without modifying the core theme files. This enables fine-tuning of the interface and expansion of functionality. However, WordPress Custom CSS and JavaScript have a dat...
CVE-2026-73246
Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...
CVE-2026-66832 Mira Hormone Monitor, Mira Android App Use of GET request method with sensitive query strings
When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...
CVE-2026-46358
A flaw was found in OpenBao. The inline authentication functionality incorrectly redacted audit log entries, causing non-authentication headers to be removed while authentication-related headers were retained in cleartext. This vulnerability requires an attacker to first compromise access to the...
CVE-2026-66145
An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 Build 9510.1044 and earlier versions which allows remote attacker to read sensitive data and perform arbitrary file write via zipslip...
EUVD-2026-56418
Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally...
