CWE-538 vulnerabilities

FreeScout versions prior to 1.8.225 have an improper authentication vulnerability in the administrative tools.php maintenance endpoint. This endpoint is accessible without proper authentication or access control, allowing attackers to probe for arbitrary directories and files on the server. Additionally, the endpoint permits unrestricted guessing of application keys and database passwords without rate limiting or CAPTCHA protections. This vulnerability is fixed in version 1.8.225.

JReviews component for Joomla versions 1.0.0 through 5.12.0 and 6.0.0 through 6.6.9 caches sensitive configuration data, including Joomla global secrets and third-party API keys, in a serialized file within a web-accessible directory. This file lacks PHP guards and the directory lacks .htaccess protection, allowing unauthenticated attackers who know the file name to read sensitive information.

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at build time into that bundle, including secrets configured in nuxt.config, and Nuxt 4.6.0 and later also inline the generated development appSecret. The default localhost binding limits remote exposure, production builds and Nitro 3 are not affected, and runtime configuration supplied only through NUXT_* environment variables at server startup is not inlined. This issue is fixed in version 4.6.3.

CVE-2026-115711 is a vulnerability in Elastic Cloud Enterprise (ECE) where sensitive information, including role tokens, is stored in a location accessible to lower-privileged platform components. This can allow an attacker with internal access to retrieve these secrets and potentially add unauthorized hosts with elevated roles. The vulnerability affects versions from 1.0.0 through 3.8.5 and 4.0.0 through 4.2.0. The CVSS score is 6.4, indicating a medium severity risk.

CVE-2026-115707 is a vulnerability in Elastic Cloud Enterprise (ECE) involving the insertion of sensitive information into an externally-accessible file or directory. After the ECE certificate rotation procedure, sensitive platform credentials and certificate authority private keys are retained in data accessible to lower-privileged platform components. An attacker with control over any host in the installation can exploit this to gain full control over the ECE control plane and managed deployments.

CVE-2026-96944 is a medium severity vulnerability in Windows 11 Version 24H2 where sensitive information may be inserted into an externally accessible file or directory. This flaw allows an authorized local attacker to disclose sensitive information. The vulnerability affects multiple Windows 11 builds prior to specific fixed versions. An official fix is available from Microsoft.

CVE-2026-57442 is a path traversal vulnerability in bitbonsai mcpvault versions prior to 0.11.5. The issue arises because the PathFilter component uses root-anchored deny-list patterns that fail to restrict nested .git, .obsidian, and node_modules directories properly. This allows an attacker influencing AI-selected paths to access restricted metadata and files. The vulnerability is fixed in version 0.11.5.

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.

CVE-2026-69507 is a vulnerability in the Microsoft Windows Search Component affecting Windows 11 version 23H2 and related builds. It involves the insertion of sensitive information into an externally accessible file or directory, which could allow an authorized attacker to disclose sensitive information over a network. The vulnerability has a CVSS score of 5.7 (medium severity) and has been officially fixed in multiple Windows builds.

Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible.

IBM Cloud Pak For Business Automation 24.0.0, 24.0.1, 25.0.0, and 26.0.0 could allow a remote attacker to obtain sensitive information exposed in manifest files.

A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and full chat payloads, which may contain personally identifiable information (PII) and secrets, to persistent logs. This sensitive data, including bearer tokens and chat content, can be accessed by any user with logging privileges. This vulnerability leads to information disclosure, potentially allowing an attacker to harvest credentials and sensitive conversation content.

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information to an authenticated user from the monitoring and event tables.

During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in cleartext to an exposed UART console on production hardware. The UART pads are labeled, run with default serial settings, and drop to an interactive RT-Thread shell that permits arbitrary memory reads, enabling full firmware extraction. An attacker with brief physical access, common for outdoor-mounted devices, can therefore recover WiFi credentials and bootstrap firmware-side attacks.

A vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA root certificate. If that CA is installed and trusted on client systems, the attacker could issue fraudulent certificates trusted by those clients and undermine the certificate trust chain.

A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed to the worker container as command-line arguments visible in the pod spec. An authenticated UI/API user with Kubernetes read-only access to the cluster (e.g. `pods/get` in the Airflow namespace) could harvest the JWT from `kubectl describe pod` output and then call state-mutating Execution API endpoints — triggering Dag runs, clearing runs, reading or writing Variables / Connections / XComs — as if they were a running task. Affects deployments using the `KubernetesExecutor`. Users are advised to upgrade to `apache-airflow` 3.2.2 or later. This is the airflow-core half of the same vulnerability addressed by [CVE-2026-27173](https://www.cve.org/CVERecord?id=CVE-2026-27173), which shipped the apache-airflow-providers-cncf-kubernetes side of the fix. Deployments that already upgraded `apache-airflow-providers-cncf-kubernetes` to 10.17.0 or later per the CVE-2026-27173 advisory should additionally upgrade `apache-airflow` to 3.2.2 or later to close the core-side surface — the two fixes are complementary, not duplicates.

CVE-2026-5434 is a vulnerability in Honeywell International Inc.'s Control Network Module (CNM) that involves the insertion of sensitive information into an unintended directory. This could allow an attacker to probe system files and potentially gain unintended access to protected data. The affected CNM versions include 100.1, 101.1, 110.1, and 110.2. Honeywell recommends updating to the most recent version 200.1 to address this issue. The vulnerability has a medium severity score of 5.9 and does not have any known exploits in the wild.

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kuberentes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.

Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. These templates expose internal application logic, variable names, AJAX endpoint URLs, and admin panel structure. This vulnerability is fixed in 1.11.38.

IBM QRadar SIEM 7.5.0 through 7.5.0 Update Package 14 stores potentially sensitive information in configuration files that could be read by a local user.