143429 matches found
CVE-2026-17442: Insertion of Sensitive Information into Log File
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to credentials being written to trace logs in cleartext...
PT-2026-85410
Name of the Vulnerable Software and Affected Versions XING CPTrans-ME-X affected versions not specified Description XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere, which may lead to the leakage of sensitive system information...
CVE-2026-19051: Plaintext Storage of a Password
Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448...
CVE-2026-16689: Insertion of Sensitive Information into Log File
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of credentials...
PT-2026-85594
IBM ContextForge MCP Gateway could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery via DNS rebinding...
CVE-2026-61614: Use of GET Request Method With Sensitive Query Strings
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the REST API authenticator accepts bearer tokens via a ?token= URL query parameter as a fallback to the X-API-TOKEN header. This causes long-lived API credentials to be recorded in server access logs, proxy logs, browser...
CVE-2026-78970: Missing Authorization
JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT token can access multiple API endpoints including queryAllUser, queryUsersByUsernames, queryUserById, and queryUsersByIds to retrieve...
CVE-2026-17627: Authorization Bypass Through User-Controlled Key
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...
CVE-2026-85094: Improper Removal of Sensitive Information Before Storage or Transfer
The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...
CVE-2026-19300: Exposure of Sensitive Information to an Unauthorized Actor
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields...
CVE-2026-85588: Exposure of Sensitive Information to an Unauthorized Actor
phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...
PT-2026-85771
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...
CVE-2026-79631: Exposure of Sensitive Information to an Unauthorized Actor
The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the public uploads directory, allowing unauthenticated users to download customer order details and opt-in form submissions when logging is enabled...
CVE-2026-19299: Improper Limitation of a Pathname to a Restricted Directory
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal...
CVE-2026-80792: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6finishoutput2 ip6finishoutput2 caches a pointer to the IPv6 destination address daddr before invoking lwtunnelxmit. The LWT-BPF transmit path or other encapsulation operations within lwtunnelxmit ca...
The vulnerability of the lpg_pwm_get_state() function in the drivers/leds/rgb/leds-qcom-lpg.c module of the Linux LED support module allows a hacker to cause a service failure.
The vulnerability of the lpgpwmgetstate function in the drivers/leds/rgb/leds-qcom-lpg.c module of the Linux LED support module is related to insufficient protection of sensitive data. Exploiting this vulnerability could allow an attacker to cause a service failure...
EUVD-2026-70746
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...
CVE-2026-9036 Vulnerabilities exists in IBM Netezza Software
IBM Netezza Software 11.3.0.3 through Interim Fix 002 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...
Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerability (CVE-2026-78658)
Summary IBM DevOps Deploy / IBM UrbanCode Deploy UCD is susceptible to an information disclosure vulnerability when processing redacted property values. CVE-2026-78658. Vulnerability Details CVEID:CVE-2026-78658 DESCRIPTION: IBM DevOps Deploy / IBM UrbanCode Deploy UCD is susceptible to an...
