IBM Guardium Data Protection version 12.2.2 logs sensitive credentials such as SECRET and API_KEY at INFO level in edge-controller and edge-manager components. An authenticated attacker with access to these logs could retrieve these credentials and potentially impersonate services or access the Guardium control plane without authorization. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS 3.1 score of 6.5 (medium severity).
CVE-2026-105452 is a medium severity vulnerability in Docker Sandboxes where client-supplied credentials can be forwarded alongside host proxy credentials due to insufficient filtering of authentication headers. This allows untrusted code running in an authorized sandbox to supply unrecognized credentials, potentially leading to authentication as an attacker-controlled account and exposure of sensitive data in requests.
MariaDB Connector/Node.js versions prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 contain a vulnerability where malformed GeoJSON Polygon and MultiPolygon data can cause uninitialized Node.js heap memory to be disclosed in database values. This occurs because the connector allocates buffer space based on an unchecked numeric length before verifying the ring is an array, leading to potential exposure of sensitive information such as other users' data, session material, database credentials, or TLS key material. The issue is fixed in the specified versions.
An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS (FOS) switches. This results in the unauthorized disclosure of the customer's SAN fabric management topology and switch connectivity attributes.
The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address.
The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network.
This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site.
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not perform any capability check, and relies on a token any authenticated user can obtain from a front-end page, before generating a report containing every customer's wallet transaction history, allowing any authenticated user, such as a subscriber, to disclose all users' names, email addresses, roles, transaction amounts, payment methods and dates.
The BackWPup WordPress plugin before 5.7.7 does not properly restrict web access to the working directory it uses during backup restores, allowing unauthenticated attackers, on webservers that do not honour .htaccess rules such as NGINX, to download the full backup archive (database dump and site files, including credentials and secret keys) left behind by an interrupted restore.
The Booking Calendar WordPress plugin before 11.8.3 does not adequately restrict which options a lower-privileged user can load through one of its settings handlers, allowing users with the Editor role and above to disclose the values of arbitrary WordPress options, including core site configuration.
The Easy Digital Downloads WordPress plugin before 3.7.1 does not restrict a block's order data to the current user, allowing users with subscriber-level access to view other customers' recent order products and obtain signed download links that grant access to paid digital files without purchase.
The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before returning that user's email address, allowing any authenticated user, such as a Subscriber, to obtain the email address of any registered account, including administrators.
The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.
The WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read WooCommerce product data, including per-product sales counts, exact stock levels, and private product meta, that WooCommerce itself keeps behind authentication.
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attackers to retrieve the key and use it to modify WooCommerce order statuses. The same log file also exposes customer information from orders the shop has processed.
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to an unauthorized actor.
CVE-2026-106120 is a vulnerability in the LiquidJS template engine where the ownPropertyOnly setting does not fully prevent access to inherited array elements through certain operations like negative indexing and filters. This can lead to exposure of sensitive information from prototype-inherited data. The issue is fixed in version 10.27.2.
## Impact
Under certain external upload configurations, Payload could send authentication data to a destination that was not verified as trusted. If the affected request contained a valid session, this could expose that session to an unintended recipient.
**You are affected if:**
- You have enabled external URL-based upload retrieval, where authenticated requests can trigger it.
## Patches
Payload now validates the destination before forwarding authentication data and reapplies that validation when a request changes destination.
Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
## Workarounds
It is recommended to update all Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
If you cannot, a valid workaround exists:
- Disable external URL-based upload retrieval where practical.
- If you cannot disable it, configure the upload header filter to remove authentication data from outbound file requests.
- Restrict access to the affected upload functionality.
PayloadCMS versions from 3.0.0 up to but not including 3.90.0, and canary versions from 4.0.0-canary.0 up to but not including 4.0.0-canary.34, contain a vulnerability where token refresh and password reset responses may expose hidden or read-restricted fields to unauthorized users. This exposure allows sensitive information leakage. The issue is resolved in versions 3.90.0 and 4.0.0-canary.34.
### Impact
A user with query access could use polymorphic join filters to infer hidden or read-restricted field values, including password-reset tokens.
You are affected if:
- You use an affected Payload version.
- Users can query a collection with a polymorphic join to sensitive fields.
### Patches
Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
### Workarounds
There is no complete workaround. Restricting read access to sensitive collections reduces exposure but does not replace upgrading.
### Impact
Under certain conditions, sorting readable records could reveal limited information about fields the requester was not permitted to read.
You are affected if untrusted users can query a collection, control its sorting, and sort by protected fields.
### Patches
Payload now applies field-level access checks to sort fields before executing queries.
Users should upgrade to `>= 3.88.0` or `>= 4.0.0-canary.27`.
### Workarounds
Upgrading is recommended. Until then, prevent untrusted users from controlling sort parameters or restrict their access to affected collections.