| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Shell allows an authorized attacker to disclose information locally. |
| Exposure of sensitive system information to an unauthorized control sphere in Windows DHCP Server allows an unauthorized attacker to disclose information over a network. |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally. |
| Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally. |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Remote Desktop Services allows an authorized attacker to disclose information over a network. |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Win32K allows an authorized attacker to disclose information locally. |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. |
| Improper access control in Windows Server for NFS allows an authorized attacker to disclose information locally. |
| Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Print Spooler Components allows an authorized attacker to disclose information over a network. |
| Exposure of sensitive information to an unauthorized actor in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally. |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Graphics Kernel allows an authorized attacker to disclose information locally. |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Bluetooth Service allows an authorized attacker to disclose information locally. |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to disclose information locally. |
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through <= 1.5.0. |
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2. |
| Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered with the masker — for example a Connection password or a Variable value — that appeared more than five containers deep under non-sensitive keys was shown in cleartext in task logs and rendered template fields. A user who can read task logs or rendered templates, but is not meant to see those secrets, could read them. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later. |
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Subscription yith-woocommerce-subscription allows Retrieve Embedded Sensitive Data.This issue affects YITH WooCommerce Subscription: from n/a through 4.22.0. |
| The BigFix MCM admin portal is directly accessible from the internet without VPN or network restriction. A client-side configuration file discloses non-sensitive environment details. Exposing the configuration file publicly increases the attack surface and the risk of unauthorized access attempts. |
| A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs. |
