PT-2026-83820

A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This impacts an unknown function of the file aca.sql of the component Password Handler. Executing a manipulation of the argument Password can lead to cleartext storage of sensitive...

CVE-2026-81280: Insertion of Sensitive Information Into Sent Data

Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders = 4.0.0 versions...

CVE-2026-75133: Missing Authentication for Critical Function

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

PT-2026-83666

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash ai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message...

PT-2026-83691

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash phoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When...

PT-2026-83690

Permissive Regular Expression vulnerability in ash-project ash phoenix lets a remote client select the tenant an Ash application uses, or degrade the request, by sending a crafted Host header. AshPhoenix.Helpers.get subdomain/2 stripped the root domain with String.replacehost, r/.?root host/, ""...

Amazon Linux 2023 : aspnetcore-runtime-10.0, aspnetcore-runtime-dbg-10.0, aspnetcore-targeting-pack-10.0 (ALAS2023-2026-2094)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2094 advisory. Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-62899 Improper...

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge browsers allows attackers to access confidential data.

The vulnerability of DevTools components in Google Chrome and Microsoft Edge stems from the lack of authentication for critical functions. Exploiting this vulnerability can allow a malicious actor to gain access to sensitive data...

EUVD-2026-68288

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and the...

CVE-2026-78693

ash_graphql (ash-project, Elixir/Erlang) is vulnerable to incomplete error-message redaction . In AshGraphql.Errors, the configured error_handler output is merged with the pre-handler path via Map.put_new(handled, :path, path), which re-injects the original path even when a sanitizing handler rem...

CVE-2026-78693 Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and the...

CVE-2026-78693 Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and the...

EEF-CVE-2026-78693 Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names

Summary Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and...

CVE-2026-78693 Incomplete redaction re-attaches the original error path in AshGraphql, leaking internal field names

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashgraphql allows a remote client to read internal field names that an application configured its errorhandler to redact. In AshGraphql.Errors, each error is passed to the configured errorhandler and the...

CVE-2026-81322

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

CVE-2026-81322

CVE-2026-81322 is an information disclosure vulnerability in ash-project ash_cloak (versions 0.1.0 through before 0.4.0). The root cause is in AshCloak.Transformers.SetUpEncryption, which creates an action argument carrying the plaintext value of a cloaked attribute. This argument inherits the se...

CVE-2026-81322 Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

EUVD-2026-68282

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

CVE-2026-81322 Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...

EEF-CVE-2026-81322 Cloaked plaintext leaks through a non-sensitive action argument in AshCloak

Summary Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ash-project ashcloak allows anyone with access to logs, error trackers, or crash reports, or anyone who can trigger a validation error, to recover the plaintext of a field the library encrypts...