143682 matches found
CVE-2026-75587: Exposure of Sensitive Information to an Unauthorized Actor
Mattermost Desktop App versions =6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to a user's diagnostics report or log files to obtain the plaintext pre-auth secret configured for a connected server via inspecting the...
CVE-2026-42164: Exposure of Sensitive Information to an Unauthorized Actor
Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section...
CVE-2026-74880: Use of GET Request Method With Sensitive Query Strings
opensslencrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access...
CVE-2026-74891: Use of Hard-coded Credentials
opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...
Unity Linux 20.1070e Security Update: rubygem-excon (UTSA-2026-099493)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099493 advisory. Excon is usable, fast, simple HTTP 1.1 for Ruby. Prior to 1.5.0, Excon's RedirectFollower middleware failed to strip additional sensitive headers when following...
PT-2026-76838
Name of the Vulnerable Software and Affected Versions iOS versions prior to 18.7.10 iPadOS versions prior to 18.7.10 iOS versions prior to 26.6.1 iPadOS versions prior to 26.6.1 macOS Tahoe versions prior to 26.6.2 Description Visiting a maliciously crafted website may lead to the leakage of...
CVE-2026-64859: Exposure of Sensitive Information to an Unauthorized Actor
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...
CVE-2026-64760: Exposure of Sensitive Information to an Unauthorized Actor
An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to leak sensitive kernel state...
PT-2026-76627
openssl encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...
CVE-2026-75057: Insertion of Sensitive Information into Log File
In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log...
Duplicati 2.2.0.3 - JWT Signing Key Leak
Exploit Title: Duplicati 2.2.0.3 - JWT Signing Key Leak Bypass leading to Token Forgery Date: 2026-06-23 Exploit Author: Gabriel Rodrigues TEXUGO from HAKAI Vendor Homepage: https://www.duplicati.com Software Link: https://github.com/duplicati/duplicati Version: = 2.2.0.3 commit 6ad921166 and...
PT-2026-76856
Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6.1 iPadOS versions prior to 26.6.1 macOS Tahoe versions prior to 26.6.2 Description A logic issue exists where an app may be able to leak sensitive user information. This was addressed by implementing improved checks...
CVE-2026-51346
SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...
PT-2026-76734
SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store functions...
PT-2026-76748
Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - 04/2026 allows a remote attacker to obtain sensitive information and execute arbitrary code...
dotnet: .NET: Information Disclosure Vulnerability
A flaw was found in .NET. This vulnerability allows an unauthorized attacker to disclose sensitive information over a network. The issue arises from the inclusion of functionality from an untrusted control sphere, which can be exploited to reveal data...
MINI-65Q8-XJQ9-HMRP
Bulletin has no description...
CVE-2024-58375
OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...