CVE-2026-69806: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally...

PT-2026-87360

Name of the Vulnerable Software and Affected Versions Windows License Manager affected versions not specified Description Exposure of sensitive system information to an unauthorized control sphere in Windows License Manager allows an authorized attacker to disclose information locally...

CVE-2026-80160: Out-of-bounds Read

Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2026-18023: Sensitive Information in Resource Not Removed Before Reuse

Sensitive Information in Resource Not Removed Before Reuse in ASUS Armoury Crate driver allows a local user to disclose sensitive information from uninitialized memory via a crafted IOCTL request that bypasses the driver's security verification mechanism. Refer to the ' Security Update for Armour...

CVE-2026-79572: Improper Restriction of XML External Entity Reference

An XXE XML External Entity vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive files, scan internal networks, or launch server attacks via supplying a crafted XML payload...

PT-2026-88076

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description An issue exists where sensitive system information is exposed to an unauthorized control sphere, allowing an unauthorized attacker to disclose information locally...

PT-2026-88531

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in Extensions allows a remote attacker to obtain sensitive information through the use of a crafted Chrome extension. Recommendations Update Google Chrome to versi...

PT-2026-87017

Name of the Vulnerable Software and Affected Versions Snowflake Connector for Python versions prior to 4.7.3 Snowflake Go Driver versions prior to 2.2.0 Snowflake JDBC Driver versions prior to 4.3.4 Snowflake Node.js Driver versions prior to 3.3.0 Snowflake PHP PDO Driver versions prior to 4.2.0...

Unauthenticated Control of NAT Rules Leading to Exposure of Sensitive Information

...

PT-2026-88705

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Missing authorization in the Contacts component allows a remote attacker to potentially obtain sensitive information. This requires the attacker to have already compromised the renderer...

PT-2026-88553

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description A confused deputy issue in BackgroundFetch allows a remote attacker who has compromised the renderer process to leak sensitive information through a crafted HTML page. A confused deputy...

PT-2026-88690

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Improper input validation in the Passwords component allows a remote attacker to potentially leak sensitive information through the use of crafted network traffic. Recommendations Updat...

PT-2026-88550

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in Permissions allows a remote attacker to obtain sensitive information through the use of a crafted Chrome extension, provided they can leverage social...

PT-2026-88576

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in the Loader component allows a remote attacker to obtain sensitive information by inducing a user to visit a crafted HTML page. Recommendations Update Google...

PT-2026-88694

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 153.0.8010.36 Description Incorrect authorization in DataTransfer allows a remote attacker who has compromised the renderer process to obtain sensitive information through a crafted HTML page. Recommendations...

Linux Distros Unpatched Vulnerability : CVE-2026-69806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally. CVE-2026-69806 Note that Nessus...

CVE-2026-82586

Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...

CVE-2026-82586 AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...

EUVD-2026-72542

Improper Protection of Alternate Path vulnerability in ash-project ashlua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resources to Lua scripts, gated by a manifest declaring which fields are exposed. The read action's...

EEF-CVE-2026-82755 ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cacheable without Vary, enabling cross-tenant confusion

Summary Use of Cache Containing Sensitive Information vulnerability in ash-project ashauthenticationoauth2server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant's clients. The RFC 8414 and RFC 9728 metadata endpoints in...