CVE-2026-18106

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input...

CVE-2026-18098

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML injection flaw...

CVE-2026-12976

The LearnPress WordPress plugin, in versions before 4.4.4 , is vulnerable to sensitive information exposure. The root cause is a failure to verify if a user is enrolled in a specific course before processing AI-assistant requests against that course's lesson content. This allows any authenticated...

PT-2026-71354

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description An integer underflow allows a remote attacker to cause a denial of service and obtain sensitive information. An integer underflow occurs when an arithmetic operation results in a value smaller than th...

PT-2026-71158

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description A remote authenticated attacker can obtain sensitive information because the system does not properly limit pathnames to restricted directories. Recommendations At the moment, there is no information...

CVE-2026-19502: Insertion of Sensitive Information into Log File

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

CVE-2026-18097: Insertion of Sensitive Information into Log File

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files...

CVE-2026-65017: Exposure of Sensitive Information to an Unauthorized Actor

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

CVE-2026-54183: Exposure of Sensitive Information to an Unauthorized Actor

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The masker's recursion-depth limit did not descend into values nested inside a list, tuple, or set beyond that limit, so an Airflow Variable holding such a deeply-nested value was show...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the parsing process. An attacker can gain unauthorized access to sensitive information by submitting a specially crafted document that triggers the inclusion of functionality from an untrusted contro...

Security Bulletin: IBM i is Affected By Out-of-Bounds Read Vulnerability [CVE-2026-16863]

Summary IBM i is vulnerable to obtaining sensitive information due to an out-of-bounds read CVE-2026-16863 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-16863 DESCRIPTION: IBM i could allow a remote authenticated attacker to obtain sensitive information d...

CVE-2026-61928

Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally...

EUVD-2026-56333

Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally...

netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing

A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate...

Windows Hello Tampering Vulnerability

Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally...

WordPress Stream – Activity Log & Audit Trail plugin <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability

Missing Authorization to Authenticated Subscriber+ Sensitive Information Disclosure vulnerability discovered by Yat in WordPress Plugin Stream versions = 4.2.0...

SUSE CVE-2026-58432

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...

PT-2026-70717

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description Use of an uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. This issue can enable attackers to obtain sensitive...

KLA91212 Multiple vulnerability in Microsoft System Center

Multiple vulnerability was found in Microsoft System Center. Malicious users can exploit this vulnerability to bypass security restrictions, obtain sensitive information. Original advisories CVE-2026-54123 Exploitation Related products Windows-Defender CVE list CVE-2026-54123 unknown Solution...

CVE-2026-20737: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive information to an unauthorized actor for some IntelR PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable...