CVE-2026-12947

CVE-2026-12947 affects IBM App Connect Enterprise versions 13.0.1.0–13.0.7.2 and 12.0.1.0–12.0.12.27. The issue involves storing potentially sensitive information in log files that could be read by a local user (CWE-532). IBM’s advisory lists the remediation via APAR IT49670, with fixes available...

CVE-2026-12947 IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodes

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user...

CVE-2026-54366

CentreStack before 17.4 contains an XML external entity XXE injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated...

CVE-2026-54366

CentreStack prior to 17.4 is affected by an XML External Entity (XXE) vulnerability in the SharePoint storage configuration handler. An unauthenticated attacker can exfiltrate arbitrary files by sending a crafted request to the StorageConfig endpoint, causing the server to fetch and parse attacke...

CVE-2026-54366

CentreStack before 17.4 contains an XML external entity XXE injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated...

vertx-core: Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects

A flaw was found in Eclipse Vert.x. The DefaultRedirectHandler in vertx-core improperly handles HTTP 30x redirects by propagating all request headers, including sensitive authentication and session credentials, to cross-origin redirect destinations. An attacker can exploit this by redirecting a...

openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy

A flaw was found in OpenSSH, a widely used tool for secure remote access. When a user attempts to copy files between two different remote systems using the scp command, the file might be incorrectly placed in a directory above the intended destination. This unintended file placement could lead to...

WordPress LifterLMS plugin < 10.0.10 - Subscriber+ Sensitive Information Disclosure vulnerability

Subscriber+ Sensitive Information Disclosure vulnerability discovered by Daniel Púa - devploit in WordPress Plugin LifterLMS versions 10.0.10...

CVE-2026-14226 Easy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing

The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...

WordPress Easy Appointments plugin <= 3.12.26 - Subscriber+ Sensitive Information Disclosure vulnerability

Subscriber+ Sensitive Information Disclosure vulnerability discovered by Phyo Ko Ko in WordPress Plugin Easy Appointments versions = 3.12.26...

CVE-2026-18011

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via physical access to the device. Chromium security severity: Low...

CVE-2026-17790

Uninitialized Use in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17683

An inappropriate implementation in ANGLE within Google Chrome prior to version 151.0.7922.72 allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This vulnerability impacts Chromium -based browsers, including Microsoft Edge . Remediatio...

CVE-2026-17975: Exposure of Sensitive Information to an Unauthorized Actor

Inappropriate implementation in IME in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

CVE-2026-18005: Exposure of Sensitive Information to an Unauthorized Actor

Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

CVE-2026-11904: Generation of Error Message Containing Sensitive Information

IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 could allow a remote attacker to obtain sensitive information when a...

JetBrains GoLand < 2026.2 Multiple Vulnerabilities

The version of JetBrains GoLand installed on the remote host is prior to 2026.2. It is, therefore, affected by multiple vulnerabilities: - In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration CVE-2026-64802 - In...

(Pwn2Own) Phoenix Contact CHARX SEC-3150 Insertion of Sensitive Information into Log File Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the generation of log files. The issue results from...

PT-2026-66567

Name of the Vulnerable Software and Affected Versions IBM UrbanCode Deploy versions 7.2 through 7.2.3.23 IBM UrbanCode Deploy versions 7.3 through 7.3.2.18 IBM DevOps Deploy versions 8.0 through 8.0.1.13 IBM DevOps Deploy versions 8.1 through 8.1.2.6 IBM DevOps Deploy versions 8.2 through 8.2.1.0...

CVE-2026-10569: Exposure of Sensitive Information to an Unauthorized Actor

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an...