CVE-2026-7189: Insertion of Sensitive Information Into Sent Data

Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Proliz's OBS: before v3.6.0...

CVE-2026-52584

Buffer Overflow vulnerability in libjxl v.0.11.2 and before allows a local attacker to obtain sensitive information via the DecodeImageAPNG function...

PT-2026-60880

Name of the Vulnerable Software and Affected Versions MCMS version 6.1.1 Description A remote attacker can obtain sensitive information by exploiting the source parameter. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2026-9656: Exposure of Sensitive Information to an Unauthorized Actor

The HubSpot All-In-One Marketing – Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.62 via the wplocalizescript / window.leadinConfig JavaScript object. This makes it possible for authenticated attackers, with...

CVE-2026-52203

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter...

PT-2026-60874

Name of the Vulnerable Software and Affected Versions IBM Db2 Genius Hub versions 1.1 through 1.1.2 IBM Agentics version 1.0 Description An attacker could execute arbitrary code or obtain sensitive information due to the use of dangerous functions without sufficient restrictions. Recommendations ...

PT-2026-60747

Insertion of sensitive information into sent data vulnerability in Proliz Software Ltd. Co. Proliz's OBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Proliz's OBS: before v3.6.0...

PT-2026-60757

Name of the Vulnerable Software and Affected Versions HCL Aftermarket EPC affected versions not specified Description The application lacks an appropriate caching policy to define how pages and form fields are stored. This allows sensitive information within application responses to be saved in t...

CVE-2026-39359 Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager's enrollment daemon authd and synchronization daemon remoted. The authd process allows agents to select ...

CVE-2026-39359

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager's enrollment daemon authd and synchronization daemon remoted. The authd process allows agents to select ...

CVE-2026-39359 Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager's enrollment daemon authd and synchronization daemon remoted. The authd process allows agents to select ...

CVE-2026-39359 Wazuh: Unauthenticated Path Traversal in authd via Agent Group Name

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager's enrollment daemon authd and synchronization daemon remoted. The authd process allows agents to select ...

EUVD-2026-45079

Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 4.0.0 through 4.10.3 and 4.11.0 through 4.14.4, a logic flaw affects the Wazuh Manager's enrollment daemon authd and synchronization daemon remoted. The authd process allows agents to select ...

CVE-2024-32389

Buffer Overflow vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.320200803132042 allows a remote attacker to obtain sensitive information via the update URLs component...

CVE-2024-32387

An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.320200803132042 allows a remote attacker to obtain sensitive information via the community string component...

CVE-2026-44174 Kirby: Arbitrary Method Call via REST API search and collection query endpoints

Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that were used in its collection queries, allowing attackers to include arbitrary model methods in their queries. This includes methods with sensitive data such as password...

EUVD-2026-45026

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can lead to exposing sensitive information or causing the affected product to become unstable or unavailable...

Malicious code in sensorium-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73c4ac95caf91cb047bab32d5202efa2dfc2e4f84a032160419a7c30739da91c sensorium-mcp starts a background poller against api.telegram.org/getUpdates and delivers received message text as prompts to locally spawned Claude...

Insertion of Sensitive Information into Log File

Overview bedrock-agentcore is an An SDK for using Bedrock AgentCore Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File through the entrypoint invocation path and emitinvocationotelattributes OpenTelemetry helper. An attacker can expose raw prompts...

CVE-2026-44969

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.calltool in src/dbtmcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configurefilelogging wrote those records to dbt-mcp.log...