PT-2026-58328

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description Windows Push Notifications contain a flaw that allows an authorized attacker to locally disclose sensitive information. This issue results in the exposure of push-notification data to...

CVE-2026-52101

An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadRemote function in upload.go...

PT-2026-58199

Name of the Vulnerable Software and Affected Versions Windows Trusted Runtime Interface Driver affected versions not specified Description An authorized attacker can locally disclose sensitive information due to an exposure of sensitive data within the Windows Trusted Runtime Interface Driver...

PT-2026-58395

Name of the Vulnerable Software and Affected Versions Windows Win32K affected versions not specified Description An issue in Windows Win32K allows an authorized attacker to locally disclose sensitive information to an unauthorized actor, which can affect the system. Recommendations At the moment,...

PT-2026-58602

Name of the Vulnerable Software and Affected Versions Windows Win32K affected versions not specified Description An issue in Windows Win32K allows an authorized attacker to locally disclose sensitive information, which can potentially affect the system. Recommendations At the moment, there is no...

PT-2026-58116

Name of the Vulnerable Software and Affected Versions Windows Ancillary Function Driver for WinSock affected versions not specified Description Cleartext transmission of sensitive information in the Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose informatio...

PT-2026-58388

Name of the Vulnerable Software and Affected Versions Windows Overlay Filter affected versions not specified Description An issue in the Windows Overlay Filter allows an authorized local attacker to disclose sensitive information. This flaw enables local users to access data that should be...

PT-2026-60107

Name of the Vulnerable Software and Affected Versions n8n-mcp versions prior to 2.57.4 Description In multi-tenant HTTP mode, an authenticated tenant can access local default-scope workflow versions backups instead of being restricted to their own tenant scope. This issue allows an authenticated...

PYSEC-2026-2343 Apache Airflow Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

A bug in Apache Airflow's Variable response masker caused nested-key redaction triggered by secret-suffixed key names like password, token, secret, apikey to be bypassed when the JSON value's nesting depth exceeded the shared secrets masker's recursion limit: the masker returned the original nest...

PYSEC-2026-2709 Open WebUI has Broken Access Control in Tool Valves

Summary Broken Access Control in Tool Valves Open WebUI supports function calling through "Tools". Function calling allows an LLM to reliably connect to external tools and interact with external APIs. Exemplary use-cases include connecting to an internal knowledge base, retrieving emails from an...

PYSEC-2026-2375 Apache Superset allows authenticated users to view sensitive data without explicit permissions

A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint disabled by default allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the A...

PYSEC-2026-2348 Apache Airflow error reporting may expose full kwargs

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values such as secrets, they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. The issue...

CVE-2026-61976

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through = 1.5.0...

CVE-2026-61977

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This issue affects JetSearch: from n/a through = 3.6.1.2...

CVE-2026-57393

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce PDF Invoice Builder: from n/a through = 2.0.8...

EUVD-2026-43310

A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and full chat payloads, which may contain personally identifiable information PII and secrets, to persistent logs. This sensitive data, including bearer tokens and...

CVE-2026-22098 Sensitive information is written to logs

Various sensitive information such as passwords and charging card UIDs are written to log files...

CVE-2026-61975 WordPress JetReviews plugin <= 3.0.1 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitive Data.This issue affects JetReviews: from n/a through = 3.0.1...

CVE-2026-61976

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through = 1.5.0...

EUVD-2026-43441

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitive Data.This issue affects JetReviews: from n/a through = 3.0.1...