PT-2026-60874

Name of the Vulnerable Software and Affected Versions IBM Db2 Genius Hub versions 1.1 through 1.1.2 IBM Agentics version 1.0 Description An attacker could execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions. Recommendations ...

CVE-2026-14503: Exposure of Sensitive Information to an Unauthorized Actor

The pCloud WP Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.3 via the wp2pclajaxprocessrequestinner. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract force generation of a...

PT-2026-60749

Name of the Vulnerable Software and Affected Versions HCL Aftermarket EPC affected versions not specified Description The application passes sensitive data through URL parameters during normal usage via the GET method. This practice can lead to the exposure of sensitive information as it may be...

PT-2026-60751

Insertion of sensitive information into sent data vulnerability in IKAS Technology Inc. E-Commerce allows Retrieve Embedded Sensitive Data. This issue affects E-Commerce: through 03062026...

ROS-20260717-73-0001

The vulnerability of the Google Chrome browser extension is related to the overflow of the heap buffer and the installation of malicious extensions. Exploiting this vulnerability can allow a remote attacker to access sensitive data, compromise its integrity, and cause service interruptions throug...

CVE-2026-13765: Missing Authorization

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the checkanswer. This makes it possible for unauthenticated attackers to extract the correct-answer markers...

PT-2026-60757

Name of the Vulnerable Software and Affected Versions HCL Aftermarket EPC affected versions not specified Description The application lacks an appropriate caching policy to define how pages and form fields are stored. This allows sensitive information within application responses to be saved in t...

CVE-2026-52584

A buffer overflow vulnerability exists in libjxl versions v.0.11.2 and before . The flaw is located within the DecodeImageAPNG function, which can allow a local attacker to obtain sensitive information or lead to unauthorized data disclosure. Several distributions have addressed this issue: Debia...

PT-2026-60869

IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2026-9592: Use of GET Request Method With Sensitive Query Strings

SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header...

PT-2026-60882

Name of the Vulnerable Software and Affected Versions libjxl versions prior to 0.11.3 Description A buffer overflow occurs in the DecodeImageAPNG function, which may allow a local attacker to obtain sensitive information. Recommendations Update libjxl to version 0.11.3 or later. As a temporary...

CVE-2026-52584

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function...

CVE-2026-9656: Exposure of Sensitive Information to an Unauthorized Actor

The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.62 via the wplocalizescript / window.leadinConfig JavaScript object. This makes it possible for authenticated attackers, with...

CVE-2026-16104: Improper Removal of Sensitive Information Before Storage or Transfer

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...

PT-2026-60640

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.4 Description An unauthenticated attacker can bypass restrictions on sensitive file types by requesting files with uppercase or mixed-case extensions e.g., .YAML, .PHP. This occurs because the default .htaccess file...

CVE-2026-62230: Improper Handling of Case Sensitivity

Grav before 2.0.4 ships a default .htaccess and reference webserver-configs/htaccess.txt whose rules blocking access to sensitive file types .yaml, .php, .json, etc. lack the NC flag, making extension matching case-sensitive. On case-insensitive filesystems Windows/NTFS, macOS/HFS+, or Docker...

CVE-2026-52584

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function...

CVE-2026-39359

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager's enrollment daemon authd and synchronization daemon remoted. The authd process allows agents to select ...

CVE-2026-39359 Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager's enrollment daemon authd and synchronization daemon remoted. The authd process allows agents to select ...

CVE-2026-39359 Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager's enrollment daemon authd and synchronization daemon remoted. The authd process allows agents to select ...