Chromium CVE-2026-87482: Cleartext transmission of sensitive data in HttpsUpgrades

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Rocky Linux 9.6 [TuxCare] Security Update: coreutils / coreutils-common / coreutils-single (ALMALINUX9.6:CLSA-2026:1783532249)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783532249 advisory. - A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access...

CVE-2026-56589: Improper Neutralization of Input During Web Page Generation

HCL BigFix Service Management is affected by a Stored Cross-Site Scripting XSS vulnerability, which could allow an attacker to inject and store malicious scripts within the application that execute when a victim views the affected page, enabling session hijacking and the theft of sensitive data...

CVE-2026-66247: Permissive Cross-domain Policy with Untrusted Domains

iControl is affected by an insecure Cross-Origin Resource Sharing CORS policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrate sensitive data within the context of the victim's active...

PT-2026-104068

Name of the Vulnerable Software and Affected Versions Meari IoT Cloud Platform OpenAPI Service affected versions not specified Description An authorization flaw exists in the OpenAPI Service that allows authenticated users to manipulate configurations of devices they do not own. This issue enable...

PT-2026-103856

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

PT-2026-103836

Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1...

PT-2026-103694

Name of the Vulnerable Software and Affected Versions BackupSheep WordPress Backup Plugin versions prior to 1.9 Description The plugin fails to properly validate its integration key, treating a blank or unset key as valid. This allows unauthenticated attackers to access backup and export endpoint...

CVE-2026-103336: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1...

PT-2026-104023

Name of the Vulnerable Software and Affected Versions EasyIO FS32 versions prior to 3.0b63 Description Johnson Controls EasyIO FS32 contains a hard-coded cryptographic key, which is a fixed secret used for encryption or decryption. This flaw allows an attacker to retrieve embedded sensitive data...

PT-2026-103855

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

AlmaLinux 9.2 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl (ALMALINUX9.2:CLSA-2026:1778072039)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778072039 advisory. - Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memor...

PT-2026-103685

Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attacker to eavesdrop on with authentication credentials and sensitive data in transit. This issue affects Hitachi Coding Software Suite: through 3.3.0...

CVE-2026-62058: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensitive Data.This issue affects CF7 Apps: from n/a through 3.7.2...

CVE-2026-101148: External Control of File Name or Path

The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or blank key as valid, which allows unauthenticated attackers to create and download full site backups, including the database with user password hashes, and to...

CVE-2026-71449: Use of Hard-coded Cryptographic Key

: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue affects EasyIO FS32: before 3.0b63...

AlmaLinux 9.6 [TuxCare] Security Update: coreutils / coreutils-common / coreutils-single (ALMALINUX9.6:CLSA-2026:1783532249)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1783532249 advisory. - A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access...

AlmaLinux 9.2 [TuxCare] Security Update: coreutils / coreutils-common / coreutils-single (ALMALINUX9.2:CLSA-2026:1783530353)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783530353 advisory. - A flaw was found in GNU Coreutils. The sort utility's begfield function is vulnerable to a heap buffer under-read. The program may access...

AlmaLinux 9.2 [TuxCare] Security Update: cloud-init (ALMALINUX9.2:CLSA-2025:1760025490)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760025490 advisory. - Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed password...

Rocky Linux 9 [CIQ] Security Update: tomcat / tomcat-admin-webapps / tomcat-docs-webapp / etc Multiple Vulnerabilities (crlsa-2026_36879)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202636879 advisory. Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-29146 Apache Tomcat: Apache Tomcat:...