CVE-2026-73178 Apache Syncope: JWT Access Token takeover

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can get access via REST to the list of existing Access Tokens, including their signed JWT body. These values can be then used to perform further REST requests,...

printix-CVE-2022-30006

CVE-2022-30006 Simple Release | Print Friendly PrintixService.exe 中存在一个“向未授权角色泄露敏感信息”或/和“暴露危险的方法或功能”漏洞，影响 Kofax Printix 的“Printix Secure Cloud Print Management”版本 1.3.1156.0 及更低版本。本地或远程攻击者能够通过调用多个 UITask 事件读取网络上的高度敏感信息。这使攻击者能够读取网络上的所有驱动程序版本（打印机和客户端）、读取敏感配置信息，并列出网络中所有打印机，即使登录用户没有查看这些信息的适当权限。...

Download Monitor <= 4.7.60 - Sensitive Information Exposure

The Download Monitor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.7.60 via REST API. This can allow unauthenticated attackers to extract sensitive data including user reports, download reports, and user data including email, role, id and...

TestRail-files.md5-IAC-scanner

TestRail-files.md5-IAC-scanner El Control de Acceso Inadecuado en Gurock TestRail versiones Ingrese el servidor en formato http:\ o https:\ El script imprimirá la ubicación del servidor/archivo, el código de estado si no es 500 y cualquier palabra clave interesante encontrada...

CVE-2026-80924

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfreesensitive for derived key buffers cryptokrb5prepareencryption and cryptokrb5preparechecksum free the buffer holding the freshly derived keys with plain kfree, leaving the key material behind in the freed...

CVE-2026-79694

Dell Secure Connect Gateway (SCG) 5.0 versions prior to 5.36.00.16 (Appliance) and 5.36.00.00 (Application) are affected by an Insertion of Sensitive Information into Debugging Code vulnerability. A low-privileged attacker with local access could exploit this flaw to achieve information exposure ...

CVE-2025-12539

CVE-2025-12539 TNC Toolbox: Web Performance : 自定义HTTP请求超时时间（默认：12秒）。 🛠️ 依赖要求 Python 3.7+ requests 包 📦 输出 可读的分步消息，涵盖检测和利用状态（含延迟）。 结构化的JSON报告，包括： 目标URL 漏洞状态 检测到的插件版本 提取的cPanel凭证（用户名、API密钥、主机名） 遇到的任何错误 示例输出： root@kitploit: "tool": "CVE-2025-12539-exploit", "description": "CVE-2025-12539 Exploit Scrip...

CVE-2025-24071

CVE-2025-24071 CNA：Microsoft Corporation 发布时间：2025-03-11 更新时间：2025-03-13 标题：Microsoft Windows 文件资源管理器欺骗漏洞 描述 Windows 文件资源管理器向未授权行为者暴露敏感信息，使未授权攻击者能够在网络上实施欺骗。 CWE-200：向未授权行为者暴露敏感信息 利用方法 只需设置好 Responder 并等待 参考链接 www.cve.org writeup（非本人所写） nvd.nist.gov msrc.microsoft.com...

CVE-2026-16006

CVE-2026-16006 is an exposure of sensitive system information vulnerability in the ASUS Armoury Crate driver . A local user with low privileges can send a crafted IOCTL request that bypasses the driver's verification mechanism, allowing them to obtain kernel virtual addresses and gain insight int...

Linux Distros Unpatched Vulnerability : CVE-2026-69806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally. CVE-2026-69806 Note that Nessus...

CVE-2026-18887 IBM i is Affected By Sensitive Information Exposure Vulnerability in PASE []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information in PASE. An attacker could exploit this vulnerability to access information about process they shouldn't be permitted to access...

Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS

Summary Affected versions of Starlette-Admin prior to 0.16.1 do not properly validate user-supplied sort and search parameters against the configured field allowlists. While the administrative UI restricts available fields based on field configuration, the backend accepts arbitrary field names...

CVE-2026-78372

creationtimestamp| type| source ---|---|--- 2026-08-24 16:00:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mttoe7lkrt25 2026-08-24 16:08:24+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mttot3qvst2u...

CVE-2026-61397 Apache CloudStack: OAuth2 Token Cross-Request Leak

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication plugin and Google OAuth integration. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to...

CVE-2026-72670 Exposure of Sensitive Information to an Unauthorized Actor in Kibana Leading to Disclosure of Fleet Proxy Credentials

A lower privileged user who holds only the privilege to read agent policies can read the entire configuration of a configured Fleet proxy. This would normally require the Fleet privilege to read settings.The proxy configuration possibly contains proxy authentication credentials and private key...

CVE-2026-58432

CVE-2026-58432 relates to Gitea (code.gitea.io/gitea) and describes missing authorization and an authorization bypass via a user-controlled key, plus incorrect permissions on a critical resource that could expose sensitive information to an unauthorized actor. The CVE is rated with CVSS v3.1 base...

CVE-2026-59507

: Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solution...

CVE-2026-59507 Priority – CWE-798: Use of Hard-coded Credentials CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-284: Improper Access Control

: Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP developed by Soft Solutions. This issue affects Portal Generator addon to Priority ERP developed by Soft Solution...

CVE-2026-16737 WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored...

EUVD-2026-56481

Exposure of sensitive information to an unauthorized actor for some IntelR PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable...