By weakness (CWE)

CWE-200: related vulnerabilities

CVEs classified under CWE-200. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

63 published vulnerabilities

• CVE-2025-69755HIGH 8.2

  A vulnerability in the Neterbit NW-431F Router (firmware version NW-431F-20241014-IR03) allows attackers on the network to read sensitive information and run unauthorized commands on the device. An attacker can send specially crafted requests to the router's at_command.asp interface without needing credentials or user interaction, making this a direct and urgent threat to any organization using this model.

• CVE-2026-0411HIGH 8.0

  A security flaw in NETGEAR Orbi mesh WiFi systems could let someone already on your network steal administrator credentials and take control of your router. The vulnerability affects specific satellite models in the RBR, RBE, and RBS product lines. Standalone Orbi systems without satellites are not at risk. An attacker with network access could escalate from regular user to full administrative control without needing to interact with the device itself.

• CVE-2026-41032HIGH 7.5

  CVE-2026-41032 is a high-severity information disclosure vulnerability affecting network controllers. An unauthenticated attacker on the same network segment can download log files from the controller without authentication, potentially exposing sensitive operational data. The vulnerability requires no user interaction and can be exploited over the network, making it a significant confidentiality risk for organizations running vulnerable controller infrastructure.

• CVE-2026-45332HIGH 7.5

  Automad versions 2.0.0-alpha.1 through 2.0.0-beta.27 contain a critical configuration flaw that exposes administrator password hashes to anyone on the internet. The setup endpoint designed to create the first user account remains publicly accessible after installation completes, leaking sensitive credential data without authentication. An attacker can retrieve every administrator's bcrypt hash with a single request, enabling offline password cracking attacks.

• CVE-2026-45553HIGH 7.5

  NiceGUI, a Python UI framework, has a file disclosure vulnerability in its reStructuredText rendering feature. When applications pass user-controlled input to the ui.restructured_text() function, attackers can exploit standard reStructuredText directives to read arbitrary files from the server. This only affects applications that process untrusted content; those using only static, trusted strings are safe. The issue is fixed in version 3.12.0.

• CVE-2026-49187HIGH 7.5

  CVE-2026-49187 is a confidentiality vulnerability in Acer Connect M6E 5G devices where hard-coded resource files embedded in the APK firmware do not expire and can be accessed via a shared mechanism. This allows an attacker to retrieve sensitive information from the device without authentication. The vulnerability does not permit data modification or service disruption, but the information exposure risk is significant enough to warrant prompt remediation.

• CVE-2026-49193HIGH 7.5

  CVE-2026-49193 is a high-severity vulnerability affecting Acer Connect M6E 5G devices where overly permissive cloud storage container settings allow telemetry data to be exposed publicly on the internet. An attacker does not need authentication or special access to view sensitive telemetry information—it is simply accessible to anyone who knows where to look. This is a data exposure risk that could reveal operational and usage patterns of affected devices and their networks.

• CVE-2026-50210HIGH 7.5

  CVE-2026-50210 affects Acer Connect M6E 5G devices, which use a flawed encryption method that reuses the same initialization vector for AES-CBC encryption. This is a cryptographic weakness that allows attackers to decrypt sensitive data without needing the encryption key, provided they can observe encrypted traffic or stored data. Because the initialization vector is static (always zeros), an attacker who captures multiple encrypted messages can correlate patterns and recover plaintext, or replay encrypted sessions to cause unintended actions.

• CVE-2026-45300HIGH 7.4

  AsyncHttpClient (AHC), a popular Java library for making HTTP requests, contains a flaw in how it handles redirects to different websites. When your application follows a redirect, the library correctly strips away sensitive authentication headers (like `Authorization` and `Proxy-Authorization`) to prevent leaking credentials to the new destination—but it fails to strip `Cookie` headers. This means session cookies and other sensitive cookie data are inadvertently sent to the redirect target, even if it's a malicious or attacker-controlled server. An attacker could exploit this by tricking a user's browser or application into following a crafted redirect chain, capturing session tokens or other sensitive cookie values. Versions 2.15.0 and 3.0.10 fix this oversight.

• CVE-2026-36611HIGH 7.3

  A Mercusys AC12G (EU) V1 router with firmware version AC12G(EU)_V1_200909 has a vulnerability that exposes uninitialized memory to attackers on the same network. When the router receives certain requests on its UPnP port without proper headers, it returns 128 bytes of raw memory content that should have been inaccessible. An attacker with network access can exploit this to leak sensitive internal data without needing credentials.

• CVE-2026-11168MEDIUM 6.5

  A vulnerability in Google Chrome's extension system allows an attacker who has already compromised the browser's renderer process to extract sensitive data from memory using a specially crafted webpage. The vulnerability requires the attacker to have control over the renderer process first, which limits the immediate attack surface but poses significant risk if combined with other exploits. The issue stems from improper implementation in how extensions interact with the rendering engine.

• CVE-2026-11180MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how SVG (Scalable Vector Graphics) content is handled that could allow an attacker to steal data from other websites. An attacker would need to trick a user into visiting a malicious webpage, but does not require any special browser plugins or user permissions beyond normal browsing. The vulnerability affects Chrome on Windows, macOS, and Linux.

• CVE-2026-11182MEDIUM 6.5

  Google Chrome contains a vulnerability in how it processes SVG (Scalable Vector Graphics) content that could allow an attacker to steal sensitive data from websites you visit. An attacker would need to trick you into visiting a malicious webpage, but if successful, they could potentially read information that should be protected between different websites—such as authentication tokens, account details, or other private data. The vulnerability affects Chrome versions before 149.0.7827.53.

• CVE-2026-11203MEDIUM 6.5

  Google Chrome on macOS has a flaw in how it handles GPU-related processes that could allow an attacker to steal sensitive data from websites you visit. The vulnerability requires user interaction—you would need to visit a malicious or compromised website—but once there, an attacker could potentially access information from other sites you have open in the browser. Google has patched this in Chrome version 149.0.7827.53 and later.

• CVE-2026-11209MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it handles password data that could allow an attacker who has already compromised Chrome's renderer process to read sensitive information from memory using a specially crafted webpage. The vulnerability requires that the attacker first gain control of the renderer process—a significant precondition—but once achieved, could expose data stored in process memory without modifying or disabling system functions.

• CVE-2026-11271MEDIUM 6.5

  Google Chrome versions before 149.0.7827.53 contain a flaw in password handling that could allow an attacker to trick users into revealing data from other websites. The vulnerability requires the attacker to craft a malicious webpage and convince the user to interact with it in a specific way—there is no automatic exploitation. The risk is confined to information disclosure; attackers cannot modify data or disrupt service. While the underlying Chromium project rates this as low severity, the CVSS score reflects the relatively low barrier to user interaction and the potential for cross-origin data leakage.

• CVE-2026-34905MEDIUM 6.5

  Apache Answer versions up to 2.0.0 contain a flaw where unlisted questions—content intended to be hidden from public view—can be discovered and read by any authenticated user through direct API calls. The vulnerability bypasses the access controls meant to keep these questions private, exposing not only the questions themselves but also their answers, comments, and revision history to users who should not have permission to see them.

• CVE-2026-42358MEDIUM 6.5

  Apache Airflow's secret-masking feature, which is supposed to hide sensitive values in Variables when they're accessed through the UI or API, has a flaw that lets authenticated users read plaintext secrets stored in deeply nested JSON structures. The masking tool gives up checking for sensitive key names (like 'password', 'token', 'secret', 'api_key') once it reaches a certain nesting depth, so secrets buried deeper than that limit slip through unmasked. Any user with permission to read Variables can exploit this. This is a follow-up to an earlier fix; that patch addressed shallow nesting, but didn't raise the depth limit itself, leaving the same bypass hole for deeper structures.

• CVE-2026-42360MEDIUM 6.5

  Apache Airflow has a flaw in how it protects sensitive information embedded within complex data structures (like JSON templates). When a workflow template is large enough to exceed Airflow's size limit for storing template data, the system converts it to plain text before masking secrets—a process that loses track of nested sensitive fields like passwords, tokens, and API keys. An authenticated user with access to read stored template fields could then retrieve these unmasked secrets. The issue affects Airflow deployments where workflow authors pass structured data containing nested sensitive values to operators. Even organizations that patched a related vulnerability (CVE-2025-68438) last year need to apply this additional update, as that earlier fix did not address this specific nested-key masking gap.

• CVE-2026-42907MEDIUM 6.5

  CVE-2026-42907 is a medium-severity information disclosure vulnerability in Windows Shell that allows an authorized user to leak sensitive data over the network. The flaw requires valid credentials to exploit but does not need user interaction, making it a concern for organizations where user trust boundaries are weak or privilege separation is inadequate. No code execution or system damage occurs; the risk is purely confidentiality loss.

• CVE-2026-45192MEDIUM 6.5

  Apache Airflow's connection API endpoint leaks sensitive credentials that should have been hidden. When a user with permission to read connections retrieves connection details via the REST API, the system fails to redact secrets stored in the connection's extra fields if they don't match known credential field names. This means passwords, API keys, and tokens for services like Slack can be exposed to any authenticated user with basic connection-read access—a permission that's often broadly granted in Airflow deployments.

• CVE-2026-45267MEDIUM 6.5

  Nextcloud versions before 5.2.6 contain a security flaw where the application fails to properly check user permissions when handling form submissions. This allows authenticated users to view form submission data belonging to other users—data they should not have access to. An attacker with valid Nextcloud credentials can exploit this to read sensitive information submitted by colleagues or other organization members through forms. The vulnerability requires an existing user account but does not need special privileges or user interaction to trigger.

• CVE-2026-46443MEDIUM 6.5

  Flowise, a no-code platform for building custom language model workflows, contains a credential exposure flaw in versions before 3.1.2. When users or applications retrieve stored credentials using a filter parameter, the system fails to remove encrypted credential data from the response—information that should never leave the server. An attacker with legitimate access to the Flowise instance could exploit this to extract encrypted credentials, potentially compromising downstream services or enabling lateral movement. The vulnerability does not affect credential retrieval when no filter is applied, indicating incomplete input-handling logic.

• CVE-2026-47284MEDIUM 6.5

  Visual Studio Code contains a flaw that can expose sensitive information to attackers over the network. An attacker can trick a user into performing an action that leads to the disclosure of confidential data, though the attacker cannot modify systems or interrupt services. This is a moderate-severity issue requiring user interaction to exploit.

• CVE-2026-47655MEDIUM 6.5

  Microsoft Graph contains a flaw that allows an authorized attacker to access sensitive information they should not be able to see. The vulnerability requires the attacker to already have valid credentials, but once authenticated, they can retrieve confidential data over the network without performing additional interactions. This is classified as a medium-severity issue because exploitation requires prior authentication, limiting the attack surface to insiders or compromised accounts.

• CVE-2026-7542MEDIUM 6.5

  The Slider Revolution WordPress plugin (versions 7.0 to 7.0.10) contains a critical information disclosure flaw that allows low-privileged users to read sensitive server files. The vulnerability chains three design weaknesses: the plugin exposes AJAX security tokens to all logged-in users, it incorrectly allows unauthenticated access to a file-copying function, and it fails to properly validate and restrict which files can be copied to the public web directory. An attacker with a basic Subscriber account can exploit this to extract configuration files, database backups, credentials, keys, and logs—essentially any non-blacklisted file type on the server.

• CVE-2026-8993MEDIUM 6.5

  The D.Launcher 2 component in the Slovak eID client ecosystem improperly handles custom URL protocols, allowing attackers to trigger NTLM authentication attempts or SMB connections to their servers, or conduct Server-Side Request Forgery (SSRF) attacks. The vulnerability requires a user to click a malicious link, making it a social engineering vector rather than an automated remote code execution. The exposure is primarily information disclosure through credential capture or network reconnaissance.

• CVE-2026-9912MEDIUM 6.5

  A flaw in Google Chrome's GPU processing on Android allows attackers to steal sensitive information from your device's memory. An attacker can craft a malicious web page that, when you visit it, extracts data from Chrome's process memory without your knowledge. No action from you is required beyond visiting the page—the vulnerability is triggered automatically during normal browsing.

• CVE-2026-9981MEDIUM 6.5

  A flaw in the Skia graphics rendering library within Google Chrome allows attackers to trick users into visiting malicious web pages that expose sensitive data from the browser's memory. The vulnerability requires user interaction (clicking a link or visiting a site) but needs no special privileges to exploit, making it a realistic threat to everyday Chrome users.

• CVE-2026-48189MEDIUM 5.7

  OTRS has released a security update addressing an input validation flaw in its Customer Backend module that allows authenticated users to bypass group-based access controls and view customer information they shouldn't have access to. The vulnerability requires that the CustomerGroupSupport feature is both enabled and actively used within the deployment. While the flaw is rated medium severity, it poses a direct confidentiality risk for organizations managing sensitive customer data through OTRS ticketing systems.

• CVE-2026-48210MEDIUM 5.7

  OTRS 2026.3.1 has a configuration issue where ticket forwarding automatically marks internal information as visible to customers, and administrators cannot turn this off through the user interface. This means sensitive ticket details that should remain internal can unintentionally become visible to external customers, creating a data leakage risk.

• CVE-2026-41980MEDIUM 5.5

  A permission control flaw in a file preview module allows unauthorized access to sensitive file contents. An attacker with local access to a system can bypass intended access restrictions and view files they should not be able to preview, potentially exposing confidential information. The vulnerability requires user interaction to trigger but does not require special privileges to exploit.

• CVE-2026-42906MEDIUM 5.5

  CVE-2026-42906 is a moderate-severity information disclosure vulnerability in Windows Shell that allows an authenticated attacker with local access to read sensitive information on a system. The flaw does not enable privilege escalation, system modification, or denial of service—it is purely about unauthorized data exposure. An attacker must already have valid login credentials and local system access to exploit it, which limits the attack surface but remains a realistic threat in environments where user account compromise is a concern.

• CVE-2026-42970MEDIUM 5.5

  A flaw in Windows Push Notifications can allow a user with local access to a computer to read sensitive information that should be protected. An attacker with an existing local account on the system could potentially view data in the push notification system without authorization. This is not a remote vulnerability and requires the attacker to already have some level of access to the machine.

• CVE-2026-42971MEDIUM 5.5

  A vulnerability in Windows Push Notifications can allow an authorized user on a system to access sensitive information they should not be able to see. The flaw requires local access and valid credentials, but once those conditions are met, an attacker can read confidential data without further user interaction. This is a local information disclosure issue affecting multiple Windows versions from Windows 10 through Windows 11, as well as Windows Server 2016 through 2025.

• CVE-2026-42972MEDIUM 5.5

  A flaw in Windows Hyper-V can leak sensitive information to users who already have local access to a system. An attacker with a standard user account on the machine could exploit this to read data they shouldn't be able to access. While the vulnerability requires existing local privileges, the information exposure is significant enough to warrant attention, particularly in multi-tenant or shared system environments.

• CVE-2026-42973MEDIUM 5.5

  CVE-2026-42973 is a Windows Push Notifications vulnerability that allows an authorized user on a local machine to read sensitive information they should not have access to. This is not a remote attack—an attacker must already have a valid user account on the system. The flaw exposes confidential data without modifying or disabling any systems, making it a disclosure risk rather than a system-breaking vulnerability.

• CVE-2026-45594MEDIUM 5.5

  CVE-2026-45594 is a medium-severity information disclosure vulnerability in Windows Application Identity (AppID) Subsystem. An attacker who already has local access to a Windows machine can exploit this flaw to read sensitive information that should not be accessible to them. The vulnerability requires the attacker to have user-level privileges and does not involve any user interaction. It affects Windows 10 and Windows 11 across multiple versions, as well as Windows Server 2016 through 2025.

• CVE-2026-10254MEDIUM 5.3

  SourceCodester Pet Grooming Management Software version 1.0 contains a vulnerability that exposes file and directory information to unauthenticated remote attackers. An unknown function in the /admin/ path fails to properly restrict access to sensitive filesystem metadata, allowing adversaries to enumerate files and directories without authentication. While this does not permit direct modification or service disruption, the information disclosure can serve as reconnaissance for subsequent targeted attacks. Public exploit code is available.

• CVE-2026-11458MEDIUM 5.3

  A flaw in erzhongxmu JeeWMS allows unauthenticated attackers to access sensitive information through an exposed Boot Actuator Endpoint at /base-boot/actuator. The vulnerability requires no special conditions to exploit and can be triggered over the network. While the issue is rated MEDIUM severity and does not allow data modification or system disruption, the information disclosure risk warrants prompt remediation. Public exploit code is available, increasing the likelihood of opportunistic attacks.

• CVE-2026-2128MEDIUM 5.3

  The Breeze WordPress plugin through version 2.5.2 contains a flaw that allows attackers to view content meant only for administrators. When the "Cache Logged-in Users" feature is enabled, the plugin trusts cookie information without properly verifying it belongs to a real, authenticated user. An attacker can craft a fake cookie claiming to be an administrator, and the plugin will serve them the cached pages generated for that admin—exposing private posts, administrative controls, security tokens, and other sensitive data. No authentication or special privileges are required to attempt this attack.

• CVE-2026-46830MEDIUM 5.3

  Oracle REST Data Services contains an information disclosure vulnerability in its Mongoapi component that allows an unauthenticated attacker to read sensitive data over the network without authentication. An attacker with network access can exploit this flaw via HTTPS to gain unauthorized visibility into data normally protected by REST Data Services, though they cannot modify or delete information. The vulnerability affects versions 24.2.0 through 26.1.0 and requires no special conditions—it's straightforward to trigger.

• CVE-2026-46841MEDIUM 5.3

  Oracle REST Data Services versions 24.2.0 through 26.1.0 contain a network-accessible vulnerability that allows unauthenticated attackers to read sensitive data. An attacker on the network can reach the service over HTTPS without credentials and gain unauthorized access to a subset of the data REST Data Services manages. This is not a critical vulnerability—it does not enable system takeover, data modification, or service disruption—but it does represent a meaningful confidentiality risk for organizations relying on REST Data Services for data access control.

• CVE-2026-50224MEDIUM 4.9

  The Acer Connect M6E 5G router's web administration panel is configured to listen on all public IPv6 addresses on port 8080, without built-in firewall protections. This means the internal API endpoints used to manage the device can be reached directly over the internet by anyone who knows the device exists and its IPv6 address, potentially allowing unauthorized access to sensitive configuration and status information.

• CVE-2026-10854MEDIUM 4.3

  CVE-2026-10854 is a visibility control flaw in MISP's event template creation feature that allowed unauthorized users to see private galaxy data from other organizations. When creating an event template, the system listed all enabled galaxies without checking whether the user's organization owned them or whether they were marked private. This exposed sensitive metadata like galaxy type and description to users who shouldn't have access. The vulnerability requires authentication to exploit and affects only information disclosure—no data modification or denial of service is possible. MISP has patched the issue by filtering galaxy visibility based on organization ownership and distribution settings.

• CVE-2026-10864MEDIUM 4.3

  A flaw in MISP's dashboard widgets allows authenticated users with low-level access to bypass field restrictions and view sensitive information they shouldn't have access to. By manipulating which data fields the New Users and New Organisations widgets display, attackers can circumvent settings designed to hide user email addresses and other restricted organization metadata. The vulnerability stems from how the application processes field filtering—if redaction leaves the field list empty, it falls back to returning unfiltered data instead of enforcing safe defaults.

• CVE-2026-11162MEDIUM 4.3

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in how the browser handles CSS that can allow attackers to steal data from other websites. An attacker would need to trick a user into visiting a malicious webpage, but once there, the flawed CSS implementation could expose sensitive information from pages the user has open in other tabs or windows. The risk is limited to information disclosure—the vulnerability does not allow attackers to modify data or crash the browser.

• CVE-2026-28511MEDIUM 4.3

  eLabFTW, an open-source electronic lab notebook platform, contains an information disclosure vulnerability affecting versions before 5.4.2. When an authenticated user performs a numeric search or reference lookup, the system may return resource titles that the user should not have access to view. The actual content of those resources remains protected—only the titles are exposed. This is particularly concerning because titles may contain sensitive information such as project names, patient identifiers, or regulated data that could constitute unauthorized disclosure.

• CVE-2026-36602MEDIUM 4.3

  A Mercusys AC12G (EU) V1 router running firmware AC12G(EU)_V1_200909 has a flaw in its UPnP service that exposes internal kernel memory addresses to anyone on the same network segment. An attacker can query the router's UPnP interface to extract a raw MIPS kernel pointer, effectively creating a roadmap of how the router's operating system is laid out in memory. While this doesn't directly compromise the device, it removes a significant barrier to follow-up attacks by revealing memory layout details that are normally hidden.

• CVE-2026-36615MEDIUM 4.3

  The Mercusys AC12G (EU) router running firmware version AC12G(EU)_V1_200909 contains an unauthenticated information disclosure vulnerability. An attacker on the same local network can access a hidden endpoint (/agileconfigreset) that leaks internal buffer contents without requiring any credentials or user interaction. This information could be used to further compromise the device or the network it serves.

• CVE-2026-36618MEDIUM 4.3

  The Mercusys AC12G (EU) router with firmware version AC12G(EU)_V1_200909 has a configuration issue that allows anyone on the local network to discover which version of the DNS resolver software (unbound 1.22.0) is running on the device. An attacker can query the router for this information and use it to identify known vulnerabilities affecting that specific DNS software version, making targeted attacks easier. This is a local network exposure only—an attacker would need network access to the router or its subnet to exploit it.

• CVE-2026-45286MEDIUM 4.3

  An authenticated user on a Nextcloud instance can discover other users' identities by abusing the Calendar app's attendee-suggestion feature. The vulnerability exists because this endpoint bypasses the access controls that Nextcloud applies elsewhere. An attacker already logged into the system can systematically enumerate valid usernames, potentially laying groundwork for targeted attacks like password spraying or social engineering. The flaw affects Nextcloud versions 5.5.13 through 5.5.16 and 6.2.0 through 6.2.2.

• CVE-2026-7526MEDIUM 4.3

  The PDF Embedder plugin for WordPress contains a flaw that allows authenticated users with basic contributor permissions or higher to access sensitive configuration information. If the premium add-on is installed with a saved license key, that key can be exposed; on free installations, the exposure is limited to non-sensitive viewer settings like dimensions and toolbar options. An attacker would need valid WordPress login credentials at the contributor level or above to exploit this, but no user interaction or network complexity is required once authenticated.

• CVE-2026-8995MEDIUM 4.3

  The Poll Maker – Versus Polls plugin for WordPress has a flaw that lets logged-in users see sensitive account information they shouldn't access, including password hashes. The vulnerability stems from an AJAX endpoint that returns the entire WordPress user object without proper security checks. Any subscriber or higher can call this endpoint and retrieve not just their own data, but potentially others' account details including email addresses, registration dates, roles, and capabilities. While the exposure doesn't immediately compromise an account, the password hash data could be targeted by offline cracking attempts.

• CVE-2026-9929MEDIUM 4.3

  A flaw in how Google Chrome on Android handles WebGL—a technology that enables 3D graphics in web browsers—could allow an attacker to trick a user into visiting a malicious webpage and expose data from other websites the user has open. The attacker cannot force this to happen; the user must interact with the page, such as by clicking or scrolling. This is a cross-origin data leak, meaning sensitive information from one domain could become visible to JavaScript code running on an attacker's domain.

• CVE-2026-9955MEDIUM 4.3

  A vulnerability in Google Chrome on iOS versions before 148.0.7778.216 allows attackers to extract sensitive information from websites the user visits. An attacker would craft a malicious webpage and trick a user into visiting it; the page can then read data intended to be private to other websites. This is a cross-origin data leak—a violation of the browser's same-origin policy that normally prevents websites from accessing each other's information.

• CVE-2026-45683LOW 3.8

  OpenTelemetry eBPF Instrumentation versions prior to 0.9.0 contain a memory disclosure vulnerability in the Java TLS monitoring probe. The vulnerability stems from incorrect kernel memory access calls that allow a local attacker to read sensitive kernel memory and exfiltrate it through the instrumentation telemetry pipeline. This is a localized information disclosure risk that requires local process-level access to exploit.

• CVE-2026-11459LOW 3.3

  SecureAge CatchPulse versions up to 10.9.3 contain a vulnerability in the saappctl.sys driver that can leak sensitive information to authenticated local users. An attacker with a valid local account on the affected system can trigger the IOCTL handler to access data they shouldn't normally see. The vulnerability has been publicly disclosed and active exploitation is possible, though it requires legitimate access to the target machine.

• CVE-2026-45277LOW 3.3

  Nextcloud's approval workflow feature contains an information disclosure flaw that allows authenticated users to determine whether arbitrary files are connected to specific approval processes. An attacker with valid credentials can probe the system to learn if particular files have approval workflows attached, potentially revealing organizational file structures and approval dependencies that should remain confidential. The issue affects versions prior to 2.7.2 and does not require user interaction to exploit.

• CVE-2026-10011LOW 3.1

  A flaw in Chrome's Skia graphics library could allow an attacker who has already compromised Chrome's renderer process to extract sensitive data from websites you visit. The attacker would need to serve you a specially crafted web page to perform the attack. While the underlying issue received a High severity rating from Chromium, the overall exploitability is limited because it requires both renderer compromise and user interaction, making it a low-risk vulnerability in practical terms.

• CVE-2026-11464LOW 3.1

  JeecgBoot versions up to 3.9.2 contain a vulnerability in the User List Endpoint that allows authenticated users to disclose sensitive information by manipulating a salt parameter. An attacker with valid credentials can exploit this flaw to access restricted data, though doing so requires specific conditions and technical knowledge. A fix is planned for a future release.

• CVE-2026-45739LOW 3.1

  Strawberry GraphQL, a popular library for building GraphQL APIs, has a flaw in its bundled GraphiQL interface (versions 0.288.4 through 0.315.3) where sensitive headers entered by developers are inadvertently exposed in the browser URL. When a developer pastes an authorization token or other credential into the GraphiQL headers editor, that value becomes part of the page URL and persists in browser history, shareable links, and server access logs. This creates a credential leakage risk if someone gains access to those logs or if links are shared. The issue has been patched in version 0.315.4.

• CVE-2026-9991LOW 3.1

  A vulnerability in Google Chrome's media handling on Windows allows an attacker who has already compromised the browser's renderer process to extract sensitive data across security boundaries. The attacker would need to host a malicious webpage and trick a user into visiting it while the renderer is already under their control. The exposure is information disclosure—no system takeover or crashes—and the barrier to exploitation is relatively high because the attacker must first achieve renderer compromise.