CVE-2026-15322: Use of GET Request Method With Sensitive Query Strings

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to obtain sensitive information due to the exposure of session tokens in URLs...

CVE-2026-52584

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function...

CVE-2026-62211: Insertion of Sensitive Information into Log File

OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to access data that should remain within trusted boundaries. Attackers can exploit misconfigured input paths or feature accessibility to expose...

CVE-2026-7488: Insertion of Sensitive Information Into Sent Data

Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data. This issue affects E-Commerce: through 03062026...

CVE-2026-7189: Insertion of Sensitive Information Into Sent Data

Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Proliz's OBS: before v3.6.0...

CVE-2024-23572: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

HCL Aftermarket EPC is vulnerable to attack as cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function...

PT-2026-60707

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the check answer. This makes it possible for unauthenticated attackers to extract the correct-answer marker...

PT-2026-60747

Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Proliz's OBS: before v3.6.0...

CVE-2026-54171: Insertion of Sensitive Information Into Sent Data

Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following redirects and did not provide a custom list of headers to strip. This could cause inadvertent leakage of sensitive data when the initial...

CVE-2026-48009: Exposure of Sensitive Information to an Unauthorized Actor

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with userrecovery:read ACL can take over any admin account by triggering POST /api/action/user/user-recovery, reading the password recovery hash through POST /api/search/user-recovery, and using PAT...

CVE-2026-49211: Exposure of Sensitive Information to an Unauthorized Actor

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards %...

CVE-2026-52203

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information by exploiting the source parameter. No information regarding a newer version containing a fix is currently available. Exploitation details are not provided in the documents.

PT-2026-60874

Name of the Vulnerable Software and Affected Versions IBM Db2 Genius Hub versions 1.1 through 1.1.2 IBM Agentics version 1.0 Description An attacker could execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions. Recommendations ...

CVE-2026-14503: Exposure of Sensitive Information to an Unauthorized Actor

The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pclajaxprocessrequestinner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a...

PT-2026-60749

Name of the Vulnerable Software and Affected Versions HCL Aftermarket EPC affected versions not specified Description The application passes sensitive data through URL parameters during normal usage via the GET method. This practice can lead to the exposure of sensitive information as it may be...

PT-2026-60751

Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data. This issue affects E-Commerce: through 03062026...

ROS-20260717-73-0001

The vulnerability of the Google Chrome browser extension is related to the overflow of the heap buffer and the installation of malicious extensions. Exploiting this vulnerability can allow a remote attacker to access sensitive data, compromise its integrity, and cause service interruptions throug...

CVE-2026-13765: Missing Authorization

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the checkanswer. This makes it possible for unauthenticated attackers to extract the correct-answer markers...

PT-2026-60757

Name of the Vulnerable Software and Affected Versions HCL Aftermarket EPC affected versions not specified Description The application lacks an appropriate caching policy to define how pages and form fields are stored. This allows sensitive information within application responses to be saved in t...

CVE-2026-52584

A buffer overflow vulnerability exists in libjxl versions v.0.11.2 and before . The flaw is located within the DecodeImageAPNG function, which can allow a local attacker to obtain sensitive information or lead to unauthorized data disclosure. Several distributions have addressed this issue: Debia...