NVIDIA NeMoClaw has a vulnerability in its sandbox environment initialization component that allows a remote attacker to cause improper access control. By sending prompt-injected content, the attacker can cause the agent to read and exfiltrate host environment variables that are not properly restricted during sandbox creation. This vulnerability can lead to the disclosure of sensitive system information. It affects all versions prior to v0.0.18. The vulnerability has a high severity with a CVSS score of 8.6. There is no confirmed patch or official remediation available at this time.
Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to continue and process the full request server-side. Unauthenticated attackers can perform file operations on project media directories including creating directories, uploading files, renaming files, duplicating files, overwriting files, and deleting files, which can be chained with path traversal and extension blocklist vulnerabilities to achieve remote code execution and arbitrary file read.
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the application root. Attackers can send a GET request to the /setup page to access the exposed root_path value rendered in the HTML response, which enables exploitation of path-dependent vulnerabilities such as relative path traversal in connector.php.
CVE-2025-15623 is a critical vulnerability in Sparx Systems Pty Ltd. 's Sparx Pro Cloud Server version 6.0.163 that allows an unauthenticated user to retrieve the database password in plaintext under certain conditions. This exposure of private personal and sensitive system information could lead to unauthorized access and compromise of the system. The vulnerability has a high CVSS 4.0 score of 9.3, indicating critical severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
An unauthenticated remote attacker can access a configuration file containing database credentials. This can result in a some loss of confidentiality, but there is no endpoint exposed to use these credentials.
CVE-2025-36373 is a medium severity vulnerability in IBM DataPower Gateway versions 10.5.0 through 10.6.5.0. It allows an administrative user to access sensitive system information from other domains, potentially exposing data that should be isolated. The vulnerability does not impact confidentiality beyond limited information disclosure, nor does it affect integrity or availability. No known exploits are reported in the wild. There is no explicit patch or remediation information provided in the available data.
CVE-2026-0231 is an information disclosure vulnerability in Palo Alto Networks Cortex XDR Broker VM version 30.0.0. It allows an authenticated user with network access to the Broker VM to trigger a live terminal session via the Cortex UI and modify any configuration setting. Exploitation requires high privileges but no user interaction. The vulnerability can lead to unauthorized exposure and modification of sensitive system information, impacting confidentiality, integrity, and availability. No known exploits are currently reported in the wild. The CVSS 4.0 base score is 5.7, indicating medium severity.
A low‑privileged remote attacker can directly interact with the wwwdnload.cgi endpoint to download any resource available to administrators, including system backups and certificate request files.
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 returns sensitive information in an HTTP response that could be used in further attacks against the system.
n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, an authenticated user with permission to create or modify workflows could use the Python Code node to escape the sandbox. The sandbox did not sufficiently restrict access to certain built-in Python objects, allowing an attacker to exfiltrate file contents or achieve RCE. On instances using internal Task Runners (default runner mode), this could result in full compromise of the n8n host. On instances using external Task Runners, the attacker might gain access to or impact other task executed on the Task Runner. Task Runners must be enabled using `N8N_RUNNERS_ENABLED=true`. The issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations. Limit workflow creation and editing permissions to fully trusted users only., and/or disable the Code node by adding `n8n-nodes-base.code` to the `NODES_EXCLUDE` environment variable. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be restricted. This could cause low impact on confidentiality of the application while integrity and availability are not impacted.
IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 returns sensitive information in an HTTP response that could be used to impersonate other users in the system.
Exposure of Sensitive System Information to an Unauthorized Actor vulnerability in Microcom ZeusWeb allows Web Application Fingerprinting of sensitive data. This issue affects ZeusWeb: 6.1.31.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vadi Corporate Information Systems Ltd. Co. DIGIKENT allows Excavation.
This issue affects DIGIKENT: through 13092025.
CVE-2025-66599 is a medium-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 through R10.04. The flaw involves the unintended disclosure of physical file system paths on web pages served by the affected products. This information disclosure can aid attackers in crafting further targeted attacks by revealing internal directory structures. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently in the wild, the exposure of sensitive path information can facilitate reconnaissance and subsequent exploitation steps. The affected FAST/TOOLS packages include RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB. European organizations using these versions in critical industrial control or monitoring environments should prioritize mitigation to reduce attack surface. No official patches have been linked yet, so compensating controls are recommended.
IBM webMethods Integration (on prem) - Integration Server 10.15 through IS_10.15_Core_Fix2411.1 to IS_11.1_Core_Fix8 IBM webMethods Integration could disclose sensitive user information in server responses.
IBM Jazz Reporting Service could allow an authenticated user on the host network to obtain sensitive information about other projects that reside on the server.
IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 could allow a local user with administration privileges to obtain sensitive information from a Virtual TPM through a series of PowerVM service procedures.
The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceClient.exe, provided by dormakaba via the Access Manager web interface, is used to connect to the socket and receive debug information. The data is permanently broadcasted on the TCP socket. The socket can be accessed without any authentication or encryption.
The transmitted data is based on the set verbosity level. The verbosity level can be set using the http(s) endpoint with the service interface password or with the guessable identifier of the device via the SOAP interface.
The transmitted data contains sensitive data like the Card ID as well as all button presses on Registration units. This allows an attacker with network level access to retrieve all entered PINs on a registration unit.