Common Weakness Enumeration
CWE-212
AllowedImproper Removal of Sensitive Information Before Storage or Transfer
Abstraction: Base · Status: Incomplete
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
194 vulnerabilities reference this CWE, most recent first.
CVE-2026-115363 (GCVE-0-2026-115363)
Vulnerability from cvelistv5 – Published: 2026-10-22 19:13 – Updated: 2026-10-22 19:13
VLAI
EPSS
VEX
Title
OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration
Summary
OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator's ACME account.
Severity
CWE
- CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/openbao/openbao/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/openbao-2.2.… | third-party-advisory |
Impacted products
Date Public
2026-10-01 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/openbao/openbao/v2",
"product": "openbao",
"vendor": "openbao",
"versions": [
{
"lessThan": "2.6.4",
"status": "affected",
"version": "2.2.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.6.4",
"versionType": "semver"
},
{
"lessThan": "2.7.1",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.7.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.6.4",
"versionStartIncluding": "2.2.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openbao:openbao:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.7.1",
"versionStartIncluding": "2.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luiggi33"
},
{
"lang": "en",
"type": "reporter",
"value": "opensec-intelligence"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 contains an information disclosure vulnerability that exposes the tls_acme_eab_mac_key value through the sys/config/state/sanitized endpoint. Callers of the sanitized configuration endpoint can retrieve the ACME External Account Binding MAC key used for TLS listener certificates, letting them bind to the operator\u0027s ACME account."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-212",
"description": "Improper Removal of Sensitive Information Before Storage or Transfer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T19:13:37.600Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-3237-j65r-m5rp)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/openbao/openbao/security/advisories/GHSA-3237-j65r-m5rp"
},
{
"name": "VulnCheck Advisory: OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openbao-2.2.0-before-2.6.4-and-2.7.0-before-2.7.1-acme-eab-mac-key-disclosure-via-sanitized-configuration"
}
],
"title": "OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-115363",
"datePublished": "2026-10-22T19:13:37.600Z",
"dateReserved": "2026-10-22T11:21:20.779Z",
"dateUpdated": "2026-10-22T19:13:37.600Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111756 (GCVE-0-2026-111756)
Vulnerability from cvelistv5 – Published: 2026-10-20 17:58 – Updated: 2026-10-23 01:59
VLAI
EPSS
VEX
Title
follow-redirects array-form headers bypass cross-origin credential stripping
Summary
follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices "0", "1", "2" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-23 01:59 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/follow-redirects/follow-redire… | x_refsource_CONFIRM |
| https://github.com/follow-redirects/follow-redire… | x_refsource_MISC |
| https://github.com/follow-redirects/follow-redire… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| follow-redirects | follow-redirects |
Affected:
>= 1.16.0, < 1.16.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111756",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-23T01:59:05.315622Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T01:59:26.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "follow-redirects",
"vendor": "follow-redirects",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.16.0, \u003c 1.16.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller\u0027s headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node\u0027s underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices \"0\", \"1\", \"2\" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim\u0027s credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-212",
"description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T17:58:21.005Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8"
},
{
"name": "https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff"
},
{
"name": "https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/follow-redirects/follow-redirects/releases/tag/v1.16.1"
}
],
"source": {
"advisory": "GHSA-q3jh-wrc6-jgq8",
"discovery": "UNKNOWN"
},
"title": "follow-redirects array-form headers bypass cross-origin credential stripping"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-111756",
"datePublished": "2026-10-20T17:58:21.005Z",
"dateReserved": "2026-10-16T17:52:09.081Z",
"dateUpdated": "2026-10-23T01:59:26.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111387 (GCVE-0-2026-111387)
Vulnerability from cvelistv5 – Published: 2026-10-16 01:17 – Updated: 2026-10-16 17:07
VLAI
EPSS
VEX
Title
Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint
Summary
Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:31 UTC
CWE
- CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nezhahq/nezha/security/advisor… | vendor-advisory |
| https://github.com/nezhahq/nezha/commit/36b742a7e… | patch |
| https://github.com/nezhahq/nezha/commit/39d398066… | patch |
| https://www.vulncheck.com/advisories/nezha-2.2.5-… | third-party-advisory |
Impacted products
Date Public
2026-10-01 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111387",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:31:55.598918Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:07:24.986Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/nezhahq/nezha",
"product": "nezha",
"vendor": "nezhahq",
"versions": [
{
"lessThan": "2.3.15",
"status": "affected",
"version": "2.2.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.3.15",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "White0xdi3"
},
{
"lang": "en",
"type": "reporter",
"value": "manus-pi"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user\u0027s DDNS webhook profiles."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-212",
"description": "Improper Removal of Sensitive Information Before Storage or Transfer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:17:55.957Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-hpfr-cmgc-f455)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-hpfr-cmgc-f455"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/nezhahq/nezha/commit/39d398066d8c644fe452f74704e34ada6c7ab61e"
},
{
"name": "VulnCheck Advisory: Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nezha-2.2.5-before-2.3.15-information-disclosure-via-ddns-list-endpoint"
}
],
"title": "Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111387",
"datePublished": "2026-10-16T01:17:55.957Z",
"dateReserved": "2026-10-15T21:55:44.537Z",
"dateUpdated": "2026-10-16T17:07:24.986Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107293 (GCVE-0-2026-107293)
Vulnerability from cvelistv5 – Published: 2026-10-08 16:57 – Updated: 2026-10-08 17:14
VLAI
EPSS
VEX
Title
Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`
Summary
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can export retry prompts outside tool calls in gen_ai.input.messages and pydantic_ai.all_messages. Agents using NativeOutput, PromptedOutput, or output validators on text output can therefore disclose validation feedback, including invalid model values quoted by that feedback, to readers of the telemetry backend. Tool-call retries and deployments that do not use include_content=False are not affected by this specific path. This issue is fixed in versions 1.107.4 and 2.27.1.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 17:14 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pydantic/pydantic-ai/security/… | x_refsource_CONFIRM |
| https://github.com/pydantic/pydantic-ai/pull/7357 | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/commit/fe… | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/releases/… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| pydantic | pydantic-ai |
Affected:
>= 0.3.4, < 1.107.4
Affected: >= 2.0.0b1, < 2.27.1 |
|
| pydantic | pydantic-ai-slim |
Affected:
>= 0.3.4, < 1.107.4
Affected: >= 2.0.0b1, < 2.27.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107293",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T17:14:19.566455Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T17:14:30.659Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pydantic-ai",
"vendor": "pydantic",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.3.4, \u003c 1.107.4"
},
{
"status": "affected",
"version": "\u003e= 2.0.0b1, \u003c 2.27.1"
}
]
},
{
"product": "pydantic-ai-slim",
"vendor": "pydantic",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.3.4, \u003c 1.107.4"
},
{
"status": "affected",
"version": "\u003e= 2.0.0b1, \u003c 2.27.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can export retry prompts outside tool calls in gen_ai.input.messages and pydantic_ai.all_messages. Agents using NativeOutput, PromptedOutput, or output validators on text output can therefore disclose validation feedback, including invalid model values quoted by that feedback, to readers of the telemetry backend. Tool-call retries and deployments that do not use include_content=False are not affected by this specific path. This issue is fixed in versions 1.107.4 and 2.27.1."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-212",
"description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T16:57:24.841Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-3gh4-cghq-f8v4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-3gh4-cghq-f8v4"
},
{
"name": "https://github.com/pydantic/pydantic-ai/pull/7357",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/pull/7357"
},
{
"name": "https://github.com/pydantic/pydantic-ai/commit/fe9dbed7b7ccf7e7128b5786886e4441f6f5594f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/commit/fe9dbed7b7ccf7e7128b5786886e4441f6f5594f"
},
{
"name": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.27.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.27.1"
}
],
"source": {
"advisory": "GHSA-3gh4-cghq-f8v4",
"discovery": "UNKNOWN"
},
"title": "Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107293",
"datePublished": "2026-10-08T16:57:24.841Z",
"dateReserved": "2026-10-07T15:53:23.586Z",
"dateUpdated": "2026-10-08T17:14:30.659Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107291 (GCVE-0-2026-107291)
Vulnerability from cvelistv5 – Published: 2026-10-08 16:22 – Updated: 2026-10-08 17:25
VLAI
EPSS
VEX
Title
Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`
Summary
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can still export sensitive agent content through exception.message and exception.stacktrace events, error status descriptions, and model_request_parameters containing instructions or the prompted_output_template. The exposed data is available to readers of the configured telemetry backend and can include tool feedback, provider error bodies, runtime instructions, and structured-output templates even though message attributes are redacted. This issue does not grant new access to agent data, and deployments that do not use include_content=False are not affected by the setting bypass. This issue is fixed in versions 1.107.6 and 2.44.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 17:25 UTC
CWE
Assigner
References
13 references
| URL | Tags |
|---|---|
| https://github.com/pydantic/pydantic-ai/security/… | x_refsource_CONFIRM |
| https://github.com/pydantic/pydantic-ai/pull/8403 | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/pull/8404 | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/pull/8408 | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/pull/8428 | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/pull/8429 | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/commit/4e… | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/commit/6b… | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/commit/7e… | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/commit/96… | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/commit/de… | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/releases/… | x_refsource_MISC |
| https://github.com/pydantic/pydantic-ai/releases/… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| pydantic | pydantic-ai |
Affected:
>= 0.3.4, < 1.107.6
Affected: >= 2.0.0b1, < 2.44.0 |
|
| pydantic | pydantic-ai-slim |
Affected:
>= 0.3.4, < 1.107.6
Affected: >= 2.0.0b1, < 2.44.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107291",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T17:25:09.227835Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T17:25:18.280Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "pydantic-ai",
"vendor": "pydantic",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.3.4, \u003c 1.107.6"
},
{
"status": "affected",
"version": "\u003e= 2.0.0b1, \u003c 2.44.0"
}
]
},
{
"product": "pydantic-ai-slim",
"vendor": "pydantic",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.3.4, \u003c 1.107.6"
},
{
"status": "affected",
"version": "\u003e= 2.0.0b1, \u003c 2.44.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can still export sensitive agent content through exception.message and exception.stacktrace events, error status descriptions, and model_request_parameters containing instructions or the prompted_output_template. The exposed data is available to readers of the configured telemetry backend and can include tool feedback, provider error bodies, runtime instructions, and structured-output templates even though message attributes are redacted. This issue does not grant new access to agent data, and deployments that do not use include_content=False are not affected by the setting bypass. This issue is fixed in versions 1.107.6 and 2.44.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-212",
"description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T16:22:51.763Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-4x9p-g9wm-8q7f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-4x9p-g9wm-8q7f"
},
{
"name": "https://github.com/pydantic/pydantic-ai/pull/8403",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/pull/8403"
},
{
"name": "https://github.com/pydantic/pydantic-ai/pull/8404",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/pull/8404"
},
{
"name": "https://github.com/pydantic/pydantic-ai/pull/8408",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/pull/8408"
},
{
"name": "https://github.com/pydantic/pydantic-ai/pull/8428",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/pull/8428"
},
{
"name": "https://github.com/pydantic/pydantic-ai/pull/8429",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/pull/8429"
},
{
"name": "https://github.com/pydantic/pydantic-ai/commit/4e013c51a50659aba2adf7853bfb22bb77f6a518",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/commit/4e013c51a50659aba2adf7853bfb22bb77f6a518"
},
{
"name": "https://github.com/pydantic/pydantic-ai/commit/6b14c74cb281f899a2ae4fae5327111e33f60771",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/commit/6b14c74cb281f899a2ae4fae5327111e33f60771"
},
{
"name": "https://github.com/pydantic/pydantic-ai/commit/7ee27e38ab2e525ca60ff1a25d16413ff989fd79",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/commit/7ee27e38ab2e525ca60ff1a25d16413ff989fd79"
},
{
"name": "https://github.com/pydantic/pydantic-ai/commit/963dec5f70d6f558997fc259356c0090cc5ea487",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/commit/963dec5f70d6f558997fc259356c0090cc5ea487"
},
{
"name": "https://github.com/pydantic/pydantic-ai/commit/de4e61515327bd80a19cd8552001c30933e6acc3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/commit/de4e61515327bd80a19cd8552001c30933e6acc3"
},
{
"name": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.6"
},
{
"name": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/pydantic-ai/releases/tag/v2.44.0"
}
],
"source": {
"advisory": "GHSA-4x9p-g9wm-8q7f",
"discovery": "UNKNOWN"
},
"title": "Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107291",
"datePublished": "2026-10-08T16:22:51.763Z",
"dateReserved": "2026-10-07T15:53:23.586Z",
"dateUpdated": "2026-10-08T17:25:18.280Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96879 (GCVE-0-2026-96879)
Vulnerability from cvelistv5 – Published: 2026-09-25 20:10 – Updated: 2026-09-29 21:22
VLAI
EPSS
VEX
Title
"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"
Summary
Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation's Mediawiki - FlaggedRevs extension through 1.46.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-25 20:41 UTC
CWE
- CWE-212 - Improper removal of sensitive information before storage or transfer
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| The Wikimedia Foundation | Mediawiki - FlaggedRevs extension |
Affected:
0 , ≤ 1.46.0
(semver)
|
Date Public
2026-09-25 19:57
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96879",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T20:41:45.708316Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T20:41:55.111Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mediawiki - FlaggedRevs extension",
"vendor": "The Wikimedia Foundation",
"versions": [
{
"lessThanOrEqual": "1.46.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"datePublic": "2026-09-25T19:57:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation\u0027s Mediawiki - FlaggedRevs extension\u003cspan\u003e\u0026nbsp;through 1.46.0.\u003c/span\u003e"
}
],
"value": "Improper removal of sensitive information before storage or transfer vulnerability in Wikimedia Foundation\u0027s Mediawiki - FlaggedRevs extension\u00a0through 1.46.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-212",
"description": "CWE-212 Improper removal of sensitive information before storage or transfer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T21:22:40.501Z",
"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"shortName": "wikimedia-foundation"
},
"references": [
{
"url": "https://phabricator.wikimedia.org/T433020"
},
{
"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/FlaggedRevs/+/1344737"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "\"Checked by\" label in page history should not be shown if the underlying review log entry is suppressed\"",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"assignerShortName": "wikimedia-foundation",
"cveId": "CVE-2026-96879",
"datePublished": "2026-09-25T20:10:22.476Z",
"dateReserved": "2026-09-23T18:14:23.766Z",
"dateUpdated": "2026-09-29T21:22:40.501Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90860 (GCVE-0-2026-90860)
Vulnerability from cvelistv5 – Published: 2026-09-21 06:43 – Updated: 2026-09-21 19:40
VLAI
EPSS
VEX
Summary
The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 14:41 UTC
CWE
- CWE-212 - Improper removal of sensitive information before storage or transfer
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90860",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T14:41:14.779044Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:40:26.358Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"HarmonyOS"
],
"product": "Canva",
"vendor": "Canva",
"versions": [
{
"lessThan": "1.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:canva:canva:*:*:harmonyos:*:*:*:*:*",
"versionEndExcluding": "1.15.1",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Wing Cheng (Canva)"
},
{
"lang": "en",
"type": "finder",
"value": "Tin Duong (Canva)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user\u2019s session.\u003c/p\u003e"
}
],
"value": "The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user\u2019s session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-212",
"description": "CWE-212 Improper removal of sensitive information before storage or transfer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T06:43:02.132Z",
"orgId": "61adb53e-e4b3-47f7-8a93-4717c9e77dc6",
"shortName": "Canva"
},
"references": [
{
"url": "https://trust.canva.com?tcuUid=c17214e0-e758-4472-8238-abeb79faff07"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "61adb53e-e4b3-47f7-8a93-4717c9e77dc6",
"assignerShortName": "Canva",
"cveId": "CVE-2026-90860",
"datePublished": "2026-09-21T06:43:02.132Z",
"dateReserved": "2026-09-14T06:04:08.646Z",
"dateUpdated": "2026-09-21T19:40:26.358Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86740 (GCVE-0-2026-86740)
Vulnerability from cvelistv5 – Published: 2026-09-09 13:32 – Updated: 2026-09-14 13:20
VLAI
EPSS
VEX
Title
Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains
Summary
Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesController::destroy(), allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses and see files hidden from listings, but the physical files persist on disk and remain accessible to anyone with filesystem or backup access.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 13:19 UTC
CWE
- CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/grokability/snipe-it/security/… | vendor-advisory |
| https://www.vulncheck.com/advisories/snipe-it-bef… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| grokability | snipe-it |
Affected:
0 , < 8.7.0
(semver)
Unaffected: 8.7.0 (semver) cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:* |
Date Public
2026-08-24 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86740",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T13:19:54.284290Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T13:20:06.064Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "snipe-it",
"vendor": "grokability",
"versions": [
{
"lessThan": "8.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.7.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:snipeitapp:snipe-it:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "christopherfi-dev"
},
{
"lang": "en",
"type": "finder",
"value": "snipe"
}
],
"datePublic": "2026-08-24T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\\\UploadedFilesController::destroy(), allowing deletion requests to report success while files remain on disk. Administrators performing attachment deletions receive success responses and see files hidden from listings, but the physical files persist on disk and remain accessible to anyone with filesystem or backup access."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.8,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-212",
"description": "Improper Removal of Sensitive Information Before Storage or Transfer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:32:06.463Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4c4h-cpgf-h4qr)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/grokability/snipe-it/security/advisories/GHSA-4c4h-cpgf-h4qr"
},
{
"name": "VulnCheck Advisory: Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/snipe-it-before-8.7.0-attachment-deletion-reports-success-while-file-remains"
}
],
"title": "Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-86740",
"datePublished": "2026-09-09T13:32:06.463Z",
"dateReserved": "2026-09-08T11:31:38.679Z",
"dateUpdated": "2026-09-14T13:20:06.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85094 (GCVE-0-2026-85094)
Vulnerability from cvelistv5 – Published: 2026-09-04 06:02 – Updated: 2026-09-04 19:46
VLAI
EPSS
VEX
Summary
The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 19:45 UTC
CWE
- CWE-212 - Improper removal of sensitive information before storage or transfer
Assigner
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85094",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T19:45:56.095685Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T19:46:06.332Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Canva",
"vendor": "Canva",
"versions": [
{
"lessThan": "2.376.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:canva:canva:*:*:*:*:*:android:*:*",
"versionEndExcluding": "2.376.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hakupiku (Bugcrowd)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user\u2019s session."
}
],
"value": "The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user\u2019s session."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-212",
"description": "CWE-212 Improper removal of sensitive information before storage or transfer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T06:02:47.444Z",
"orgId": "61adb53e-e4b3-47f7-8a93-4717c9e77dc6",
"shortName": "Canva"
},
"references": [
{
"url": "https://trust.canva.com/?tcuUid=be2ebc32-7053-4885-bf71-68771aa4589a"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "61adb53e-e4b3-47f7-8a93-4717c9e77dc6",
"assignerShortName": "Canva",
"cveId": "CVE-2026-85094",
"datePublished": "2026-09-04T06:02:47.444Z",
"dateReserved": "2026-09-02T23:55:47.015Z",
"dateUpdated": "2026-09-04T19:46:06.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82069 (GCVE-0-2026-82069)
Vulnerability from cvelistv5 – Published: 2026-09-08 16:12 – Updated: 2026-09-08 17:53
VLAI
EPSS
VEX
Title
Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router
Summary
A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users' operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-08 17:52 UTC
CWE
- CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| MongoDB | MongoDB Server |
Affected:
8.3.0 , < 8.3.9
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82069",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-08T17:52:44.414393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T17:53:00.855Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MongoDB Server",
"vendor": "MongoDB",
"versions": [
{
"lessThan": "8.3.9",
"status": "affected",
"version": "8.3.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A security issue in MongoDB Server\u0027s query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users\u0027 operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface."
}
],
"value": "A security issue in MongoDB Server\u0027s query statistics serialization on the router allows users with monitoring privileges to access unredacted search query text from other users\u0027 operations. An improper conditional check in the serialization logic causes the data redaction mechanism to be bypassed when processing search queries through the sharded cluster router. This results in sensitive query literals being stored and made accessible through the query statistics interface."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-212",
"description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T16:12:28.213Z",
"orgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"shortName": "mongodb"
},
"references": [
{
"url": "https://jira.mongodb.org/browse/SERVER-132835"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router",
"x_generator": {
"engine": "cve_record_builder.py"
}
}
},
"cveMetadata": {
"assignerOrgId": "a39b4221-9bd0-4244-95fc-f3e2e07f1deb",
"assignerShortName": "mongodb",
"cveId": "CVE-2026-82069",
"datePublished": "2026-09-08T16:12:28.213Z",
"dateReserved": "2026-08-27T22:53:17.721Z",
"dateUpdated": "2026-09-08T17:53:00.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Requirements
Clearly specify which information should be regarded as private or sensitive, and require that the product offers functionality that allows the user to cleanse the sensitive information from the resource before it is published or exported to other parties.
Mitigation MIT-46
Architecture and Design
Strategy: Separation of Privilege
- Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
- Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Mitigation MIT-57
Implementation
Operation
Strategy: Attack Surface Reduction
- Some tools can automatically analyze documents to redact, strip, or "sanitize" private information, although some human review might be necessary. Tools may vary in terms of which document formats can be processed.
- When calling an external program to automatically generate or convert documents, invoke the program with any available options that avoid generating sensitive metadata. Some formats have well-defined fields that could contain private data, such as Exchangeable image file format (Exif), which can contain potentially sensitive metadata such as geolocation, date, and time [REF-1515] [REF-1516].
Mitigation MIT-33
Implementation
Strategy: Attack Surface Reduction
Use naming conventions and strong types to make it easier to spot when sensitive data is being used. When creating structures, objects, or other complex entities, separate the sensitive and non-sensitive data as much as possible.
Mitigation
Implementation
Avoid errors related to improper resource shutdown or release (CWE-404), which may leave the sensitive data within the resource if it is in an incomplete state.
CAPEC-168: Windows ::DATA Alternate Data Stream
An attacker exploits the functionality of Microsoft NTFS Alternate Data Streams (ADS) to undermine system security. ADS allows multiple "files" to be stored in one directory entry referenced as filename:streamname. One or more alternate data streams may be stored in any file or directory. Normal Microsoft utilities do not show the presence of an ADS stream attached to a file. The additional space for the ADS is not recorded in the displayed file size. The additional space for ADS is accounted for in the used space on the volume. An ADS can be any type of file. ADS are copied by standard Microsoft utilities between NTFS volumes. ADS can be used by an attacker or intruder to hide tools, scripts, and data from detection by normal system utilities. Many anti-virus programs do not check for or scan ADS. Windows Vista does have a switch (-R) on the command line DIR command that will display alternate streams.