CVE-2026-86414 is a critical vulnerability in curl where an HTTP proxy can cause libcurl to send the origin's credentials (such as Basic authentication passwords or Negotiate/Kerberos tickets) to the proxy itself. This occurs because the proxy responds to a CONNECT tunnel request with a 401 WWW-Authenticate response instead of the expected 407 Proxy-Authenticate response, leading to unintended credential disclosure.
CVE-2026-86413 is a critical vulnerability in curl versions 8.21.0 and 8.22.0 where, during a Negotiate authentication with an ambient user and redirect following enabled, curl may inadvertently send credential details to an unrelated second origin. This can lead to sensitive information disclosure.
CVE-2026-86409 is a vulnerability in curl where setting the CURLOPT_AWS_SIGV4 option to NULL does not disable AWS SigV4 authentication as expected. This causes the curl handle to continue sending an Authorization header with AWS4-HMAC-SHA256 to subsequent URLs, potentially leaking sensitive authentication information.
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.
Mattermost versions 11.7.0, 11.8.0, 11.9.0, and 11.10.0 contain a vulnerability where the active channel field returned by the user status API endpoints is not properly sanitized. This flaw allows an authenticated user to discover the channel ID of a private channel that another user is actively viewing, even if the attacker is not a member of that channel. The vulnerability is tracked as CVE-2026-19603 and has a medium severity rating.
Mattermost versions 11.7.0, 11.8.0, 11.9.0, and 11.10.0 contain a vulnerability where the stored AD/LDAP bind password is not invalidated when connection settings are changed. This flaw allows a System Console administrator to inadvertently expose the plaintext bind password to an attacker-controlled server via the Test Connection or diagnostics feature.
Mattermost versions 11.7.0, 11.8.0, 11.9.0, and 11.10.0 contain a vulnerability where the system does not require re-entry of the stored client secret when validating outgoing OAuth connections. This flaw allows an authenticated user with permission to manage outgoing OAuth connections to retrieve the client secret by directing the token URL to an attacker-controlled endpoint and triggering validation.
CVE-2026-66822 is a vulnerability in Microsoft .NET 10.0 runtime involving the insertion of sensitive information into sent data, which can allow unauthorized disclosure of information over a network. The flaw affects multiple .NET runtime versions prior to their respective fixed releases. The vulnerability has a medium severity rating with a CVSS score of 5.9. An official fix is available from Microsoft.
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.
CVE-2026-107761 is a medium severity vulnerability in GitroomHQ's postiz-app where certain API endpoints expose sensitive data unnecessarily. The channel delete endpoint returns deleted integration rows including platform access and refresh tokens, allowing authorized third-party OAuth apps to misuse social platform credentials. The user organizations endpoint exposes organization API keys to all members, not just admins, enabling unauthorized API calls on behalf of the organization. Access to these endpoints requires valid authentication and is limited to the caller's own organization, preventing anonymous or cross-tenant access.
CVE-2026-62043 is a high-severity vulnerability in the sevenspark Contact Form 7 – Dynamic Text Extension plugin versions up to 5.0.7. It involves unauthenticated exposure of sensitive data due to insertion of sensitive information into sent data. This flaw allows an attacker without authentication to access sensitive information transmitted by the plugin.
CVE-2026-42630 is a high-severity vulnerability in Web Plura Backup & Restore Manager versions up to 0.2.25. It involves unauthenticated exposure of sensitive data due to insertion of sensitive information into sent data. This flaw allows an attacker without authentication to access sensitive information, impacting confidentiality but not integrity or availability.
CVE-2026-42419 is a vulnerability in Swish Migrate and Backup versions up to 1.4.0 that allows unauthenticated exposure of sensitive data due to insertion of sensitive information into sent data. The vulnerability has a medium severity with a CVSS score of 5.9. No patch or remediation information is provided.
A vulnerability in the WP Rollback plugin (up to version 3.1.2) allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. This issue is identified as CVE-2026-66435 and has a medium severity rating with a CVSS score of 5.9. The vulnerability does not affect availability or integrity but impacts confidentiality. No patch or remediation information is currently provided.
An authenticated Ops Manager organization member can retrieve another member's pending authenticator enrollment seed through user-listing endpoints while that member's enrollment is unconfirmed. This results in disclosure of secret authentication material to another member of the same organization or project.
Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources.
This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26.
CVE-2026-66666 is a vulnerability in Automattic WordPress that allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. It affects multiple WordPress versions from 6.6 through 7.1.2. The vulnerability has a medium severity with a CVSS score of 6.9. No official patch or remediation details are provided in the available data.
### Impact
Users with read access to other user documents could access their active API keys. An exposed key grants the target account’s permissions until rotated or disabled.
You are affected if:
- An authentication collection enables `useAPIKey`.
- Users have read access to other user documents containing active API keys.
### Patches
Users should upgrade payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
### Workarounds
Disable `useAPIKey` or restrict users to reading only their own authentication document. Rotate any API key that may have been exposed.
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data.
This issue affects Motors: from n/a through 1.4.124.