Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

Impact Sensitive information exposure in the Infracost Terraform Cloud/Enterprise integration. Several code paths attached a configured secret token to a request whose host was taken straight from the scanned Terraform, with no check that the host was the trusted endpoint. The condition that...

EUVD-2026-74033

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction...

CVE-2026-77108 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction...

CVE-2026-77108 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction...

CVE-2026-76202 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction...

EUVD-2026-74032

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction...

EUVD-2026-73918

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-69806

CVE-2026-69806 is a .NET Elevation of Privilege vulnerability caused by exposure of sensitive information to an unauthorized actor, which an authorized local attacker can exploit to escalate privileges. The CVSS 3.1 score is 7.0 (HIGH) with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H , indicat...

EUVD-2026-73870

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

CVE-2026-81394

CVE-2026-81394 is an information disclosure vulnerability in Microsoft Office Excel . Exposure of sensitive system information to an unauthorized control sphere allows a local, unprivileged attacker to disclose information, provided the target user interacts with a crafted file. The CVSS 3.1 scor...

CVE-2026-81387

CVE-2026-81387 is an information disclosure vulnerability in Microsoft Office Excel . It allows an unauthorized attacker with local access to expose sensitive system information, requiring user interaction and no prior privileges. The CVSS v3.1 score is 5.5 (MEDIUM) , with high confidentiality im...

EUVD-2026-73856

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

CVE-2026-65812

Microsoft Teams for Android is affected by an information disclosure vulnerability caused by the insertion of sensitive information into sent data, allowing an authorized attacker to disclose information over a network. The CVSS 3.1 score is 6.8 (Medium) , with a network attack vector, low comple...

EUVD-2026-73739

Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network...

CVE-2026-26084

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests...

EUVD-2026-73446

Exposure of sensitive system information to an unauthorized control sphere in Windows License Manager allows an authorized attacker to disclose information locally...

CVE-2026-69294

Microsoft COM for Windows is affected by an information disclosure vulnerability caused by the generation of an error message containing sensitive information. An authorized local attacker can exploit this to disclose information, with no user interaction required. The CVSS 3.1 score is 5.5 (Medi...

EUVD-2026-73413

Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally...

CVE-2026-68873

CVE-2026-68873 is an information disclosure vulnerability in the Windows Program Compatibility Assistant Service . The root cause is the insertion of sensitive information into a log file maintained by the service, allowing an authorized local attacker with low privileges to read and disclose tha...

CVE-2026-68842

CVE-2026-68842 is an information disclosure vulnerability in the Windows MIDI Service Module , where sensitive system information is exposed to an unauthorized control sphere. An authorized attacker with local access and low privileges can disclose confidential information, with high impact to co...