CVE-2026-19424

CVE-2026-19424 affects Inventec Appliances’ Chiline Cloud. It describes an Insecure Direct Object Reference allowing unauthenticated remote attackers to modify a parameter to read other users’ sensitive data. The CVSS metrics indicate a high risk: CVSS‑3.1 base score 7.5 (NETWORK, LOW attack comp...

SUSE CVE-2026-58432

Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea...

PT-2026-70765

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description An out-of-bounds read allows an unauthorized attacker to disclose sensitive information over a network. Recommendations At the moment, there is no information about a newer...

PT-2026-70592

Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Description Improper removal of sensitive information before storage or transfer allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, there is no informatio...

PT-2026-70389

Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally...

CVE-2026-48767: Exposure of Sensitive Information to an Unauthorized Actor

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper getAccessToken. The vulnerable path checks only whether the caller has read access...

CVE-2026-73229: Exposure of Sensitive Information to an Unauthorized Actor

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's restframework/renderers.py AdminRenderer.render uses overridemethod to simulate GET and directly invokes view.get without view.checkpermissions while rendering an invalid write...

PT-2026-70717

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description Use of an uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. This issue can enable attackers to obtain sensitive...

KLA91212 Multiple vulnerability in Microsoft System Center

Multiple vulnerability was found in Microsoft System Center. Malicious users can exploit this vulnerability to bypass security restrictions, obtain sensitive information. Original advisories CVE-2026-54123 Exploitation Related products Windows-Defender CVE list CVE-2026-54123 unknown Solution...

PT-2026-70621

Name of the Vulnerable Software and Affected Versions Microsoft Office Word affected versions not specified Description An out-of-bounds read exists in Microsoft Office Word, which allows an unauthorized attacker to disclose sensitive information locally and affect the system. An out-of-bounds re...

PT-2026-70904

『We recently revisited those patches and found that none of the underlying root causes were fixed - every original CVE remained exploitable,』😩 SonicWall GMS - Unauthenticated RCE and Encrypted Password Hash Extraction CVE-2026-66145 https://t.co/hp0HOWboM9...

PT-2026-70937

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's worker/src/main/java/io/kestra/worker/endpoint/WorkerEndpoint.java serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables,...

PT-2026-70447

Name of the Vulnerable Software and Affected Versions Windows Hello affected versions not specified Description Sensitive information is stored in cleartext, which allows an authorized attacker to perform local tampering to affect the system. Recommendations At the moment, there is no information...

CVE-2026-62900

Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network...

CVE-2026-48386: Use of a Broken or Risky Cryptographic Algorithm

ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction...

Devolutions Server <= 2026.1.22 / 2026.2.0 <= 2026.2.11 Multiple Vulnerabilities (DEVO-2026-0024)

The version of Devolutions Server installed on the remote host is prior or equal to 2026.1.22 or 2026.2.0 prior or equal to 2026.2.11. It is, therefore, affected by multiple vulnerabilities, including: - Improper authorization in the access request status endpoint allows an authenticated...

CVE-2026-20737: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive information to an unauthorized actor for some IntelR PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable...

CVE-2026-66832: Use of GET Request Method With Sensitive Query Strings

When the Mira Android app opens in-app WebView content e.g., shop redirect flows, the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web...

PT-2026-70052

Name of the Vulnerable Software and Affected Versions Chiline Cloud affected versions not specified Description Chiline Cloud developed by Inventec Appliances contains an Insecure Direct Object Reference IDOR issue. This occurs when an application provides direct access to objects based on...

PT-2026-70409

Name of the Vulnerable Software and Affected Versions AMD Zen affected versions not specified Description An issue in AMD Zen allows an authorized attacker to locally disclose sensitive information, which can affect the system. Recommendations At the moment, there is no information about a newer...