CWE-359 vulnerabilities

A vulnerability in Angular's HttpClient xsrfInterceptorFn prior to versions 20.3.34 and 21.0.3 allows an attacker to cause the X-XSRF-TOKEN header to be attached to cross-origin requests. This occurs because the interceptor uses a regular expression that does not normalize URLs like the browser's parser, leading to misclassification of attacker-controlled URLs with backslashes or whitespace as same-origin. An attacker can exploit this to obtain the victim's XSRF token and perform cross-site request forgery if permissive CORS policies are in place. The issue is fixed in Angular versions 20.3.34 and 21.0.3.

OpenHuman before version 0.56.0 on macOS contains an improper authorization vulnerability that allows JavaScript in a remote account webview to invoke getDisplayMedia without a live user gesture. This leads to automatic screen capture if the application has macOS Screen Recording permission, potentially exposing sensitive desktop content. The issue is fixed in version 0.56.0.

CVE-2026-85916 is a vulnerability in Microsoft Windows 11 version 23H2 that allows exposure of private personal information to an unauthorized actor via Azure Active Directory. The flaw enables an unauthorized attacker to disclose information locally without requiring user interaction or privileges. This issue affects multiple builds of Windows 11 23H2 prior to their respective fixed versions. A patch is available from Microsoft to address this vulnerability.

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, URL schemes, or destination addresses before privileged fetches. The affected paths are rhwp-chrome/manifest.json, rhwp-chrome/content-script.js, rhwp-chrome/sw/message-router.js, rhwp-chrome/sw/thumbnail-extractor.js, rhwp-firefox/manifest.json, rhwp-firefox/content-script.js, rhwp-firefox/sw/message-router.js, and rhwp-firefox/sw/thumbnail-extractor.js. An untrusted page can make the fetch-file and extract-thumbnail handlers request localhost or private-network resources. When a target HWP or HWPX file contains an extractable PrvImage, the extension returns the preview as a data URI in page-readable DOM, allowing page script to read it. The flaw also permits internal-resource existence and port probing and extension presence or version fingerprinting. Exploitation requires a user to visit an untrusted page while the extension is enabled, and preview disclosure is limited to an extractable PrvImage. This issue is fixed in rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4.

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django `Model` instance is assigned to a public view attribute, djust serialized it to the client with no sensitive-field denylist — sending fields such as `password` (the hash), privilege flags (e.g. `is_staff` / `is_superuser`), tokens, and other PII to the browser. Because exposing model objects to templates is a normal djust pattern, this could leak credentials/PII without the developer realizing the full object crossed the wire. This is fixed in djust 1.0.7. Model serialization applies a secure-by-default sensitive-field denylist (password/hash/token/secret-style fields and known privilege flags are withheld) with an identity-subset fallback. As a workaround, keep `Model` instances on `_private` attributes and expose only the specific fields needed, until patched.

CVE-2026-73008 is a vulnerability in the Windows Biometric Service of Microsoft Windows 10 that allows an authorized local attacker to expose private personal information. The flaw affects multiple Windows 10 versions prior to specific fixed releases. The vulnerability has a medium severity rating with a CVSS score of 5.5. An official fix is available from Microsoft.

CVE-2026-69351 is a medium severity vulnerability in Microsoft Windows 10's Universal Plug and Play (UPnP) Device Host component. It allows an authorized local attacker to expose private personal information without authorization. The vulnerability affects multiple Windows 10 versions prior to specific fixed releases. An official fix is available from Microsoft.

HCL Connections versions 7.0 and 8.0 contain an information disclosure vulnerability (CWE-359) that allows unauthorized users to access sensitive information due to improper handling of request data. The vulnerability has a low severity with a CVSS score of 3.1. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CrossWatch versions prior to 0.9.21 have an information exposure vulnerability where an unauthenticated GET request to /api/app-auth/status returns metadata about all active sessions. This includes IP addresses, User-Agent strings, internal session IDs, and session timestamps. The issue is fixed in version 0.9.21.

CVE-2026-58510 is a medium severity vulnerability in Gitea Open Source Git Server affecting versions up to 1.26.4. The issue involves a failure to apply a fix (GHSA-8fwc-qjw5-rvgp) to the API EditRepo path, resulting in stale repository watches persisting when a repository's visibility changes from public to private. This can lead to unintended information disclosure due to retained watch states.

XWiki Platform is a generic wiki platform. XWiki discovered that the patch for GHSA-5cf8-vrr8-8hjm was insufficient. Starting with version 6.2.1 and prior to versions 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17, with slightly modified parameters to the `LiveTableResults`, it is still possible to discover password hashes one bit at a time, so with 768 requests, the full password salt and hash can be retrieved of a user. The check for password (and email properties) has been adjusted in XWiki 18.0.0RC1, 17.10.13, 17.4.9 and 16.10.17. As a workaround, the patch can be applied manually to the wiki page `XWiki.LiveTableResultsMacros`.

CVE-2026-24078 is an information disclosure vulnerability in Qualcomm Snapdragon products that occurs when IPSec negotiation fails or is not properly established during NG-eCall SIP signaling. This flaw can expose private personal information to unauthorized actors. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No official patch or remediation guidance has been provided by the vendor as of the publication date. The affected products include a broad range of Qualcomm Snapdragon chipsets and related components.

Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network.

Exposure of private personal information to an unauthorized actor in Microsoft Defender allows an authorized attacker to disclose information locally.

9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated request logs and retrieve complete AI conversation histories including system prompts, user messages, assistant responses, tool calls, and user email addresses by querying the request-logs and request-details API routes which lack authentication middleware.

Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.

Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.

Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/public/check-in-lists/{short_id}/attendees to read attendee data and create or delete check-in records without authentication.

phpUploader before 2.0.2 contains an unauthenticated information disclosure vulnerability that allows remote attackers to access the full contents of the uploaded-files database table by visiting any page of the application. The index model executes an unbounded SELECT query and embeds the complete JSON-encoded result set in an inline script block, exposing uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints.