Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
CVE-2026-108018 is a vulnerability in HCLSoftware's BigFix MCM & Mobile product where the admin portal is accessible directly from the internet without VPN or network restrictions. A client-side configuration file publicly exposes non-sensitive environment details, which increases the attack surface and the risk of unauthorized access attempts.
CVE-2026-110390 is a vulnerability in the FlexNet Beacon component of Flexera One and FlexNet Manager Suite. It involves missing authentication for critical functionality, allowing unauthenticated remote attackers to access Beacon policy and targeting information when anonymous web server access is enabled, which is the default setting. This issue affects versions prior to 26.4.1 and version 0. A fix is available in version 26.4.1 and later releases.
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar.
Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a same-origin request, which carries no Origin header. The paths usually reveal the local username and the project layout.
This issue affects tidewave: from 0.8.0 before 0.9.2.
CVE-2026-108089 is a high-severity vulnerability in Apache Cocoon that allows unauthenticated users to access sensitive diagnostic interfaces. This includes triggering cache operations and viewing verbose debug logs and profile information. The vulnerability affects all versions of Apache Cocoon. Since the project is retired and no fixes will be released, users are advised to either migrate to alternative solutions or restrict access to trusted users only.
Plack::Middleware::ETag versions 0.04 up to but not including 0.06 for Perl disclose file inode numbers in the default ETag header when the response body is a filehandle and the file_etag option is not set. This exposure allows clients to gain sensitive system information that could be used for backend fingerprinting and correlating files served through different URLs. The issue is fixed in version 0.06.
WisdomGarden's Tronclass versions 1.77 and 1.78 contain a vulnerability (CVE-2026-110466) that allows authenticated remote attackers to bypass anonymous grading restrictions and access anonymous student information. This issue is classified as a sensitive data exposure (CWE-497) with a medium severity rating and a CVSS 4.0 score of 5.3.
CVE-2026-96948 is a vulnerability in the Windows Client Side Caching driver (csc.sys) that allows an authorized local attacker to disclose sensitive system information. This exposure could aid an attacker in further attacks but does not allow modification or denial of service. The issue affects multiple versions of Windows 10 and earlier Windows versions, with official patches available.
CVE-2026-85866 is a vulnerability in Windows 10 Version 1809 and later versions that allows an authorized local attacker to disclose sensitive system information via the Windows ALPC component. The flaw involves exposure of sensitive system information to an unauthorized control sphere. Microsoft has released official fixes for affected versions to address this issue.
CVE-2026-70261 is a vulnerability in Microsoft Trace Data Helper on Windows 10 Version 1607 and related builds that allows an authorized attacker to locally disclose sensitive system information. The flaw exposes sensitive system information to an unauthorized control sphere, potentially compromising confidentiality. The vulnerability has a medium severity with a CVSS score of 5.5 and has been officially fixed in multiple Windows 10 versions.
CVE-2026-70260 is a vulnerability in Microsoft Trace Data Helper that allows an authorized local attacker to disclose sensitive system information. The flaw involves exposure of sensitive system information to an unauthorized control sphere. It affects multiple versions of Windows 10 and Windows Server editions prior to specific fixed builds. The vulnerability has a medium severity rating with a CVSS score of 5.5. An official fix is available and has been released by Microsoft.
CVE-2026-83925 is a vulnerability in Microsoft Windows 10 Version 1607 involving the use of an uninitialized resource in the Windows Kernel. This flaw allows an authorized local attacker to disclose sensitive information. The vulnerability affects multiple Windows 10 builds prior to their respective fixed versions. An official fix is available from Microsoft.
CVE-2026-83907 is a vulnerability in Windows Hello on Microsoft Windows 10 Version 21H2 and related builds that allows an authorized local attacker to disclose sensitive system information. The flaw involves exposure of sensitive system information to an unauthorized control sphere. Microsoft has released official fixes for affected versions to address this issue.
CVE-2026-83905 is a vulnerability in Windows Shell that allows an authorized local attacker to disclose sensitive system information to an unauthorized control sphere. The flaw affects multiple versions of Windows 10 and Windows Server 2012 R2. Microsoft has issued official fixes for all affected versions. The vulnerability has a medium severity rating with a CVSS score of 4.7 and does not require user interaction for exploitation.
CVE-2026-83897 is a vulnerability in the Windows Win32 Kernel Subsystem that allows an authorized local attacker to disclose sensitive system information. The flaw involves exposure of sensitive system information to an unauthorized control sphere. This vulnerability affects multiple versions of Windows 10 and earlier Windows versions, with official fixes available in specific updates.
CVE-2026-83835 is a buffer over-read vulnerability in the Windows Common Log File System Driver affecting multiple versions of Microsoft Windows 10, including Version 1607. An authorized local attacker can exploit this flaw to disclose information. The vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released to address this issue.
CVE-2026-83774 is a vulnerability in the Windows Win32 Kernel Subsystem that allows an authorized local attacker to disclose sensitive system information. The flaw affects multiple versions of Windows 10 and earlier Windows versions. The vulnerability has been assigned a medium severity score of 4.7. Official patches have been released to address this issue.
CVE-2026-83773 is a vulnerability in the Windows MIDI Service Module of Windows 11 Version 24H2 that allows an authorized local attacker to disclose sensitive system information. The flaw involves exposure of sensitive system information to an unauthorized control sphere. This vulnerability has a medium severity rating with a CVSS score of 5.5. Official patches have been released to address the issue in specific Windows 11 builds.
CVE-2026-83672 is a vulnerability in Windows Installer that allows an authorized local attacker to disclose sensitive system information to an unauthorized control sphere. The flaw affects multiple versions of Windows 10 and earlier Windows versions. A fix has been officially released by Microsoft.
CVE-2026-70232 is a vulnerability in the Windows Kernel that allows an authorized local attacker to disclose sensitive system information to an unauthorized control sphere. The vulnerability affects multiple versions of Windows 10 and earlier Windows versions. A fix has been officially released by Microsoft for all affected versions.