CVE-2025-36290 IBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate validation vulnerability in JWT service component

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-36271 IBM Integrated Analytics System (IIAS) is affected by a predictable salt vulnerability in Magneto component

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the WebSocket subscription handlers for packets, algorithm-status, and mdb-changes. An attacker can access sensitive data by subscribing to these WebSocket topics without the privilege checks that are enforced i...

CVE-2026-82181 Le-yan｜Medical Practice Management System - Sensitive Data in URL

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files...

EUVD-2026-67715

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files...

Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is affected by an unsafe deserialization and exposure of sensitive information (CVE-2026-14512, CVE-2026-14528 )

Summary IBM WebSphere Application Server used by IBM Tivoli System Automation Application Manager is affected by an unsafe deserialization and exposure of sensitive information. Vulnerability Details CVEID:CVE-2026-14512 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 traditional is...

EUVD-2026-67288

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality...

EUVD-2026-67279

A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback. The manipulation results in cleartext transmission of sensitive information. The attack may be performed fro...

CVE-2026-81836

A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback. The manipulation results in cleartext transmission of sensitive information. The attack may be performed fro...

CVE-2026-42392: Exposure of Sensitive Information to an Unauthorized Actor

An attacker that has valid credentials can send an invalid IMAP URLFETCH command, which causes uninitialized memory to be included in the error response returned to the client. Process memory contents can be disclosed to the client, which may include sensitive data. Disable the IMAP URLAUTH...

CVE-2026-61783: Exposure of Sensitive Information to an Unauthorized Actor

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is...

CVE-2026-51617: Improper Access Control

Incorrect access control in the getSysStatusCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as operation mode, firmware version, serial number, WAN/LAN IP addresses, WiFi SSID, encryption keys, and connected client statistics...

CVE-2026-18891: Improper Authentication

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication...

CVE-2026-82181: Use of GET Request Method With Sensitive Query Strings

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files...

PT-2026-83319

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

PT-2026-83320

Name of the Vulnerable Software and Affected Versions IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 Description The system fails to properly validate TLS certificates. This flaw allows an attacker to perform man-in-the-middle techniques to intercept and obtain sensitive...

CVE-2026-51625: Improper Access Control

Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83155

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files...

The vulnerability of the mctp_flow_prepare_output() function in the net/mctp/route.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the mctpflowprepareoutput function in the net/mctp/route.c module of the Linux kernel is related to deficiencies in the deserialization mechanism, due to insufficient protection of sensitive data. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2026-61783 Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because the logic that masks sensitive values is...