CWE-497
CWE-497 · 48 records · 5 with a public proof-of-concept
Records the NVD classes under CWE-497, highest CVSS first.
- CRITICAL 9.1CVE-2026-44945public PoC
A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transit…
- HIGH 7.5CVE-2026-123465
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2.
- HIGH 7.5CVE-2026-108089
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose) …
- HIGH 7.5CVE-2026-102387
Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.
- HIGH 7.4CVE-2026-111079
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters …
- MEDIUM 6.5CVE-2026-97740
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
365 apps · microsoft 365 · office 2021 · office 2024 · office online server
- MEDIUM 6.5CVE-2026-27553
A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclosure of all user password hashes.
- MEDIUM 6.3CVE-2026-108018
The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction. A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and th…
- MEDIUM 5.6CVE-2026-96865
Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-96948
Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-96935
Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-85793
Exposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Service allows an authorized attacker to disclose information locally.
windows 10 1607 · windows 10 1809 · windows 10 21h2 · windows 10 22h2 · windows 11 23h2 · windows 11 24h2
- MEDIUM 5.5CVE-2026-83907
Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83893
Exposure of sensitive system information to an unauthorized control sphere in Windows Clipboard User Service allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83835
Buffer over-read in Windows Common Log File System Driver allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83773
Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83713
Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-83705
Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70261
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70260
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70232
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70199
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-70055
Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-69644
Exposure of sensitive system information to an unauthorized control sphere in Windows iSCSI allows an authorized attacker to disclose information locally.
- MEDIUM 5.5CVE-2026-108462
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
- MEDIUM 5.3CVE-2026-121779
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Subscription yith-woocommerce-subscription allows Retrieve Embedded Sensitive Data.This issue affects YITH WooCommerce Subscription: from n/a thro…
- MEDIUM 5.3CVE-2026-76435
A vulnerability in Cisco Expressway Series could allow an unauthenticated, remote attacker to obtain sensitive information from an affected device. This vulnerability is due to insufficient authorization checks of HTTP requests during Mobile and Remote Acce…
- MEDIUM 5.3CVE-2026-78356
The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve internal application configuration that is intended for use by the authenticated Agent Frontend. The exposed information…
- MEDIUM 5.3CVE-2026-66480
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.
- MEDIUM 5.3CVE-2026-105073
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows Retrieve Embedded Sensitive Data.This issue affects WP Event Solution: from n/a through 4.1.25.
- MEDIUM 5.3CVE-2026-97181
GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs.
- MEDIUM 5.3CVE-2026-84712
A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous respon…
- MEDIUM 5.3CVE-2026-95600
Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.
- MEDIUM 4.7CVE-2026-85866
Exposure of sensitive system information to an unauthorized control sphere in Windows ALPC allows an authorized attacker to disclose information locally.
- MEDIUM 4.7CVE-2026-83925
Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
- MEDIUM 4.7CVE-2026-83909
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- MEDIUM 4.7CVE-2026-83905
Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally.
- MEDIUM 4.7CVE-2026-83897
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- MEDIUM 4.7CVE-2026-83774
Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally.
- MEDIUM 4.7CVE-2026-83672
Exposure of sensitive system information to an unauthorized control sphere in Windows Installer allows an authorized attacker to disclose information locally.
- MEDIUM 4.3CVE-2026-110466
Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information.
- MEDIUM 4.3CVE-2026-62036
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI All Bootstrap Blocks all-bootstrap-blocks allows Retrieve Embedded Sensitive Data.This issue affects All Bootstrap Blocks: from n/a through 1.3.31.
- MEDIUM 4.3CVE-2026-104401
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp allows Retrieve Embedded Sensitive Data.This issue affects Memberful - Membership Plugin: from n/a through 1.81.2.
- UNSCOREDCVE-2026-113504public PoC
Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys …
- UNSCOREDCVE-2026-110390
Missing authentication in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite allows unauthenticated remote attackers to obtain Beacon policy and targeting information when anonymous web server access is enabled (the default).
- UNSCOREDCVE-2026-109823public PoC
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address…
- UNSCOREDCVE-2026-111946public PoC
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification ti…
- UNSCOREDCVE-2026-106106public PoC
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/s…