WS-2020-0010

All versions of simple-crypto-js use AES-CBC with PKCS7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data...

WS-2019-0365

In Gun, prior to v0.2019.416 there is vulnerability that allows access to sensetive resources without limitation...

WS-2019-0287

Ibmdb before 2.6.0 is vulnerable to Sensitive Data Exposure. The package printed database credentials in plaintext in logs while in debug mode...

WS-2019-0247

In loopback, versions before v2.42.0 2.x and before v3.26.0 3.x are vulnerable to sensitive data exposure when Invalid API requests to the login endpoint may return information about the first user in the database...

WS-2018-0204

Versions of pem before 1.13.2 expose sensitive data when the readPkcs12 is used...

WS-2019-0057

All versions of sequelize-cli are vulnerable to Sensitive Data Exposure. The function filteredURL does not properly sanitize the config.password value which may cause passwords with special characters to be logged in plain text...

WordPress Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity plugin <= 3.3.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peng Zhou in WordPress Plugin Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity versions = 3.3.6...

CVE-2026-28962

This issue was addressed with improved access restrictions. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5. Processing maliciously crafted web content may disclose sensitive user information...

CVE-2026-28958

A flaw was found in WebKitGTK. Processing or loading malicious web content can allow an app to access sensitive user data due to improper data protection. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require...

EUVD-2026-30207

Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information CWE-319 vulnerability. A man-in-the-middle attacker may access and modify communications transmitted in plaintext, potentially resulting in information disclosure or data tampering...

WS-2018-0147

All versions of put are vulnerable to Uninitialized Memory Exposure. The package incorrectly calculates the allocated Buffer size and does not trim the bytes written, which may allow attackers to access uninitialized memory containing sensitive data. This vulnerability only affects versions of...

CVE-2026-41281

Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information CWE-319 vulnerability. A man-in-the-middle attacker may access and modify communications transmitted in plaintext, potentially resulting in information disclosure or data tampering...

Windows TCP/IP Disclosure Sensitive Information

The vulnerability of the TCP/IP protocol implementation in Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information that is protected by the system...

PT-2026-40951

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description Sensitive backend infrastructure details may be exposed, potentially revealing internal system architecture or configuration details. This exposure could assist in further analysis or target...

PT-2026-40954

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description Backend service details may be transmitted over insecure HTTP channels, which can expose sensitive information to potential interception or unauthorized access during transmission under...

PT-2026-40952

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description The auto-complete functionality is enabled for certain input fields, which may allow sensitive information to be stored in the browser. This could lead to unintended exposure of data under...

PT-2026-41149

Name of the Vulnerable Software and Affected Versions dbt-mcp versions prior to 1.17.1 Description dbt-mcp is a Model Context Protocol server for interacting with dbt. The DbtMCP.call tool function in src/dbt mcp/mcp/server.py logs the raw arguments dictionary at the INFO level before every tool...

Microsoft Authenticator information leakage vulnerability

Microsoft Authenticator is an application for multi-factor authentication developed by Microsoft Corporation in the United States. There is an information leakage vulnerability in Microsoft Authenticator. This vulnerability stems from the exposure of sensitive information to unauthorized...

PT-2026-40950

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description Certain operations may trigger out-of-band interactions, which are communication channels that occur outside the primary data stream. This behavior can lead to the unintended disclosure of...

PT-2026-40958

Name of the Vulnerable Software and Affected Versions HCL AION affected versions not specified Description Sensitive information may be included in URL parameters. Passing sensitive data in URLs can expose it through browser history, logs, or intermediary systems, potentially leading to unintende...