CVE-2026-70199 is a vulnerability in the Windows Kernel that allows an authorized local attacker to disclose sensitive system information. This exposure occurs due to improper handling of sensitive data within the kernel, potentially leading to information disclosure without user interaction. The vulnerability affects multiple versions of Windows 10 and Windows Server, with official fixes released by Microsoft.
CVE-2026-70055 is a vulnerability in Windows Cryptographic Services that allows an authorized local attacker to disclose sensitive system information. The flaw involves exposure of sensitive system information to an unauthorized control sphere. It affects multiple versions of Windows 10 and Windows Server 2012/2012 R2. A patch is available and has been officially released by Microsoft.
CVE-2026-97740 is a vulnerability in Microsoft Office Excel within Microsoft 365 Apps for Enterprise that allows unauthorized disclosure of sensitive system information over a network. The flaw involves exposure of sensitive system information to an unauthorized control sphere. It has a CVSS score of 6.5, indicating medium severity. Multiple affected versions prior to fixed releases are identified. Official fixes have been released by Microsoft.
CVE-2026-96935 is a vulnerability in Windows NTFS that allows an authorized local attacker to disclose sensitive system information to an unauthorized control sphere. The flaw affects multiple Windows 10 versions and Windows Server versions prior to specific fixed releases. The vulnerability has a medium severity rating with a CVSS score of 5.5. An official fix is available and has been released by Microsoft.
CVE-2026-96865 is a vulnerability in Windows 10 Version 1607 and later versions that allows an authorized local attacker to disclose sensitive system information due to exposure in Windows Secure Kernel Mode. The flaw affects multiple Windows 10 builds prior to specific patched versions. The vulnerability has a medium severity rating and has been officially fixed by Microsoft in several updates.
CVE-2026-85793 is a vulnerability in the Windows Sysmain Service on Windows 10 Version 1607 and later versions up to specified builds. It allows an authorized local attacker to disclose sensitive system information due to exposure to an unauthorized control sphere. The vulnerability has a medium severity with a CVSS score of 5.5. Official patches have been released to address this issue.
CVE-2026-83909 is a vulnerability in the Windows Win32 Kernel Subsystem that allows an authorized local attacker to disclose sensitive system information. The flaw affects multiple versions of Windows 10 and earlier Windows versions. Microsoft has released official fixes for all affected versions. The vulnerability has a medium severity rating with a CVSS score of 4.7 and does not require user interaction for exploitation.
CVE-2026-83893 is a vulnerability in the Windows Clipboard User Service on Windows 10 Version 1809 and related builds that allows an authorized local attacker to disclose sensitive system information. The flaw involves exposure of sensitive system information to an unauthorized control sphere. This vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released by Microsoft to address this issue.
CVE-2026-83713 is a medium-severity vulnerability in the Windows Universal Disk Format File System Driver (UDFS) that allows an authorized local attacker to perform an out-of-bounds read, potentially disclosing sensitive system information. This flaw affects multiple versions of Windows 10 and Windows Server 2012/2012 R2. Microsoft has released official fixes for all affected versions.
CVE-2026-83705 is a vulnerability in Windows HTTP.sys that allows an authorized local attacker to disclose sensitive system information. The flaw involves exposure of sensitive system information to an unauthorized control sphere. It affects multiple versions of Windows 10 and Windows Server, with fixes available in specific updated versions.
CVE-2026-69644 is a vulnerability in Windows iSCSI that allows an authorized attacker with local access to disclose sensitive system information. The flaw involves exposure of sensitive system information to an unauthorized control sphere. This vulnerability affects multiple versions of Windows 10 and Windows Server 2012/2012 R2. Microsoft has released official fixes for all affected versions.
CVE-2026-108462 is a vulnerability in the Windows Kernel that allows an authorized local attacker to disclose sensitive system information. The flaw involves exposure of sensitive system information to an unauthorized control sphere. This issue affects multiple versions of Windows 10 and earlier Windows versions. Microsoft has released official fixes for all affected versions.
CVE-2026-78356 is a vulnerability in OTRS that allows unauthenticated remote users to access the Agent Frontend configuration endpoint. This exposure reveals internal application configuration details intended only for authenticated users, such as frontend routes, authorization groups, authentication settings, enabled features, and third-party integrations. The disclosed information does not include user credentials nor allow unauthorized configuration changes but may aid attackers in fingerprinting the system and planning further attacks. The issue affects multiple OTRS versions including 8.0.x, 2023.x, 2024.x, 2025.x, and 2026.x before 2026.7.x.
CVE-2026-66480 is a vulnerability in YITH WooCommerce Product Add-Ons that allows unauthorized exposure of sensitive system information. This issue affects versions up to and including 4.34.0. The vulnerability does not require privileges or user interaction to exploit and has a medium severity rating based on a CVSS score of 5.3.
Backdrop CMS versions 1.34 before 1.34.5 and 1.35 before 1.35.1 have a vulnerability where configuration export archives are not properly cleaned up after creation. This can lead to multiple configuration archive files persisting on the system. The vulnerability requires that the export operation was previously requested by a user with the 'Synchronize, import, and export configuration' permission. A related issue allows remote anonymous access to one specific archive filename, but this is separate from the main incomplete cleanup flaw.
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.
IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due to incorrect permissions assignment.