EEF-CVE-2026-78216 AshLua eval read operations can read field-policy-protected fields via aggregates

Summary AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation list, min, max, first, sum, avg that builds an ad-hoc Ash.Query.Aggregate over a named field and returns its raw value. Ash field policies redact forbidden fields on returned record...

EUVD-2026-72926

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests...

CVE-2026-26084

A improper access control vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow attacker to access sensitive information via crafted HTTP requests...

CVE-2026-79572

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

Win32k Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally...

Windows Kernel Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally...

Skype for Business Information Disclosure Vulnerability

Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network...

Windows Error Reporting Information Disclosure Vulnerability

Generation of error message containing sensitive information in Windows Error Reporting allows an authorized attacker to disclose information locally...

Windows Print Spooler Components Information Disclosure Vulnerability

Generation of error message containing sensitive information in Windows Print Spooler Components allows an authorized attacker to disclose information over a network...

Windows Program Compatibility Assistant Service Information Disclosure Vulnerability

Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally...

Microsoft SQL Server Information Disclosure Vulnerability

Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network...

Windows License Manager Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows License Manager allows an authorized attacker to disclose information locally...

Microsoft COM for Windows Information Disclosure Vulnerability

Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally...

Microsoft Teams for Android Information Disclosure Vulnerability

Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network...

Microsoft Excel Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

Microsoft Excel Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

Windows MIDI Service Module Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally...

Windows MIDI Service Module Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally...

Microsoft Windows Search Component Information Disclosure Vulnerability

Insertion of sensitive information into externally-accessible file or directory in Microsoft Windows Search Component allows an authorized attacker to disclose information over a network...

Atarim < 4.2.2 - Sensitive Information Exposure

Vito Peleg Atarim = 4.2 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data remotely, exploit requires no special privileges. id: CVE-2025-60188 info: name: Atarim...