CVE-2026-0290: Insufficiently Protected Credentials

An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a local attacker to view sensitive data...

PT-2026-71555

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

PT-2026-71598

Unauthenticated Sensitive Data Exposure in KiviCare = 4.5.1 versions...

PT-2026-71809

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to a stack-based buffer overflow...

PT-2026-71413

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor...

PT-2026-71556

Subscriber Sensitive Data Exposure in Payment Forms for Paystack = 4.0.5 versions...

CVE-2026-66443: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

PT-2026-71523

Name of the Vulnerable Software and Affected Versions WP Event SOlution versions prior to 4.1.19 Description The Event SOlution plugin for WordPress allows authenticated attackers with customer-level access or higher to extract sensitive user or configuration data. Recommendations Update to a...

CVE-2026-66462: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Unauthenticated Sensitive Data Exposure in WooCommerce Appointments = 5.3.8 versions...

CVE-2026-66432: Exposure of Sensitive System Information Due to Uncleared Debug Information

Subscriber Sensitive Data Exposure in WPJAM Basic = 7.0.2.1 versions...

CVE-2026-19502

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

CVE-2026-18097 IBM® Db2® federated server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files...

CVE-2026-19502 Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the Config API when multi-team mode is enabled and the API is exposed. An attacker can obtain sensitive team-scoped Celery broker credentials by accessing configuration-read endpoints...

CVE-2026-17110 IBM i is Affected By Multiple Vulnerabilities in SQL

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege management...

CVE-2026-17266

IBM i (7.6, 7.5, 7.4, 7.3) is affected by CVE-2026-17266 in Navigator for i, a path traversal flaw that could allow a remote authenticated attacker to obtain sensitive information by improper limitation of a pathname to a restricted directory. CVSS base 6.5 (Network, Low attacker effort, Privileg...

CVE-2026-68970 Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level...

Vulnerabilities in Adobe Commerce

Adobe has identified several vulnerabilities in Adobe Commerce. These vulnerabilities primarily involve incorrect authorization, which allows attackers with varying privilege levels to circumvent security checks. This enables attackers to obtain unauthorized read and write permissions, access...

CVE-2026-16737

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored...

CVE-2026-16253 Total Upkeep < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret

The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's...