CVE-2026-126091

iDentalSoft website information exposure

Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-56065

WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through 2.17.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Doofinder Wordpress-extensions

Products

Doofinder For Woocommerce Doofinder For Woocommerce

CVE-2026-62850

FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled brute-force of application secrets

FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.225, the administrative tools.php maintenance endpoint is reachable without an appropriate authentication or access-control boundary. Response differences for attacker-controlled path values disclose whether arbitrary directories and files exist on the server. The same endpoint validates application-key and database-password candidates without rate limiting, per-session throttling, or a CAPTCHA, allowing unrestricted guessing attempts against application secrets. This issue is fixed in version 1.8.225.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Freescout Helpdesk

Products

Freescout

CVE-2026-118494

Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9

Joomla Extension - jreviews.com - Secret configs cached in a web-accessible in JReviews 1.0.0-5.12.0, 6.0.0-6.6.9 - JReviews caches its full settings table, including the Joomla global configuration secret (copied into cms_secret) and third-party API keys and secrets, to a serialized file under components/com_s2framework/tmp/cache/core/ inside the web root. The file has no PHP guard and the directory has no .htaccess, so anyone who knows the file name can read it without authentication.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Jreviews.com

Products

Jreviews Component For Joomla

CVE-2026-109970

Clevis: clevis: pkcs#11 token pin written to world-readable file

A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Openshift and 2 more

CVE-2026-120673

Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

A component of the MongoDB Rust Driver that records diagnostic tracing data can capture command content before automatic client-side field level encryption is applied. In deployments that turn on the optional tracing capability together with automatic in-use encryption, a party with read access to the application's exported trace data may obtain field values that the application designated for encryption, without access to the encryption keys. This may result in unintended disclosure of data.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Rust Driver

CVE-2026-115711

Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). ECE stores runtime information about platform service containers in a location that lower-privileged platform components can read, and this information includes secrets from the container configuration. An attacker with access to the internal ECE platform services can obtain these secrets, which include role tokens. A role token can let the attacker add an unauthorized host to the installation with the roles of that token.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elastic Cloud Enterprise

CVE-2026-115707

Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read this data. An attacker who controls any host in the installation can use this data to get full control of the ECE control plane and of the deployments that it manages.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Elastic

Products

Elastic Cloud Enterprise

CVE-2012-4574

Pulp: red hat cloudforms: pulp in red hat cloudforms: information disclosure via world-readable configuration file

A flaw was found in Pulp, as used in Red Hat CloudForms. This vulnerability allows a local user to read the administrative password due to world-readable permissions on the `pulp.conf` configuration file. This information disclosure could enable unauthorized access to sensitive system credentials.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cloudforms Systemengine Cloudforms Tools Redhat

Products

1 1 Cloudforms and 1 more

CVE-2026-119199

Nuxt dev server exposes private runtime config through the Nitro dev bundle

Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.3, the Nuxt development server can expose the Nitro 2 development bundle at <buildDir>/dev/index.mjs through Vite file serving when the server is reachable over HTTP. Nitro inlines private runtimeConfig values resolved at build time into that bundle, including secrets configured in nuxt.config, and Nuxt 4.6.0 and later also inline the generated development appSecret. The default localhost binding limits remote exposure, production builds and Nitro 3 are not affected, and runtime configuration supplied only through NUXT_* environment variables at server startup is not inlined. This issue is fixed in version 4.6.3.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nuxt

Products

Nuxt

CVE-2026-96944

Windows Storage Information Disclosure Vulnerability

Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 and 8 more

CVE-2026-114195

WordPress ShopMagic plugin <= 4.9.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through 4.9.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-15574

Vllm-orchestrator-gateway: vllm-orchestrator-gateway: authorization header and full chat payloads logged at hard-coded debug default

A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorization headers and full chat payloads, which may contain personally identifiable information (PII) and secrets, to persistent logs. This sensitive data, including bearer tokens and chat content, can be accessed by any user with logging privileges. This vulnerability leads to information disclosure, potentially allowing an attacker to harvest credentials and sensitive conversation content.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Red Hat Openshift Ai (rhoai) Openshift Ai

CVE-2026-112027

light0011 cms Uploadify check-exists.php file_exists file information disclosure

A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file_exists of the file Public/Home/js/uploadify/check-exists.php of the component Uploadify. The manipulation of the argument filename results in file and directory information exposure. The attack may be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Light0011

Products

Cms

CVE-2026-108858

Predibase LoRAX through 0.12.1 API Token Exposure via Router Logs

Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /generate request bodies into router logs. Attackers with access to router logs or OTLP trace backends can recover other users' private-adapter tokens recorded through the instrumented GenerateParameters span field.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Predibase

Products

Lorax

CVE-2026-108937

code-projects Online Ticket Reservation System medallion.sql file information disclosure

A vulnerability was detected in code-projects Online Ticket Reservation System 1.0. This vulnerability affects unknown code of the file /database/medallion.sql. The manipulation results in file and directory information exposure. It is possible to launch the attack remotely. The exploit is now public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Online Ticket Reservation System

CVE-2026-106499

Backstage: Secret-derived values may be exposed in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or modify Scaffolder templates are affected. A template author could cause secret-derived values used during template iteration to be persisted and exposed to users who can access the resulting task logs. This issue is fixed in version 4.1.0.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Backstage Linuxfoundation

Products

Backstage Plugin-scaffolder-backend Backstage and 1 more

CVE-2026-44828

Qexo initialization endpoint can reset setup state and expose stored credentials

Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Qexo

Products

Qexo

CVE-2026-106504

Backstage: Sensitive information exposure in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. This issue is fixed in version 4.1.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Backstage Linuxfoundation

Products

Backstage Plugin-scaffolder-backend Backstage and 1 more

CVE-2026-92872

pgpool-II: pgpool-II: Information disclosure via log files

Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pgpool Global Development Group

Products

Pgpool-ii