Monthly
Local information disclosure in AMI Aptio V BIOS/UEFI firmware allows low-privileged local attackers to access sensitive data, with potential follow-on privilege escalation and limited integrity/availability impact. The issue is medium-severity, requires pre-existing local access and high attack complexity, is not remotely reachable, and has no public exploit identified at time of analysis; AMI advisory AMI-SA-2026002 should be reviewed for affected versions and fixes.
Graylog Server's system catalog entity titles API endpoint leaks protected database fields - including user password hashes - to authenticated requesters who craft custom field-selection parameters. PR:L authentication is required, and permission checks are partially enforced: regular users are limited to their own password hash, but any user holding an admin role can extract password hashes for every account in the system. No public exploit or CISA KEV listing has been identified; vendor-released patch 7.1.4 is available and is the only remediation.
Information disclosure vulnerability in HCL Connections 8.0 allows an authenticated low-privilege user to access sensitive data through a vulnerable endpoint, requiring user interaction. No public exploit or active exploitation has been identified, and the overall risk is low.
Nomysem, an education and consulting management platform by Turkish vendor NOMYSOFT Informatics, exposes sensitive information to authenticated low-privilege users due to incompatible ACL policies that fail to properly constrain access to restricted functionality. Network-accessible endpoints can be reached by any valid account holder, yielding high-confidentiality-impact data exposure without requiring elevated rights or user interaction. No public exploit code has been identified at time of analysis; however, the vendor failed to respond to coordinated disclosure, leaving the vulnerability unpatched.
Connections versions up to 7.0 contains a vulnerability that allows attackers to obtain limited information when a single piece of internal metadata is returned (CVSS 3.5).
Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to excessive data exposure, allowing attackers to access sensitive information without proper filtering. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Dario Health Internet-based server infrastructure is vulnerable due to exposure of development environment details, which could lead to unsafe functionality. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Concert 1.0.0, 1.0.1, and 1.0.2 is vulnerable to sensitive information disclosure through specially crafted API Calls. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Local information disclosure in AMI Aptio V BIOS/UEFI firmware allows low-privileged local attackers to access sensitive data, with potential follow-on privilege escalation and limited integrity/availability impact. The issue is medium-severity, requires pre-existing local access and high attack complexity, is not remotely reachable, and has no public exploit identified at time of analysis; AMI advisory AMI-SA-2026002 should be reviewed for affected versions and fixes.
Graylog Server's system catalog entity titles API endpoint leaks protected database fields - including user password hashes - to authenticated requesters who craft custom field-selection parameters. PR:L authentication is required, and permission checks are partially enforced: regular users are limited to their own password hash, but any user holding an admin role can extract password hashes for every account in the system. No public exploit or CISA KEV listing has been identified; vendor-released patch 7.1.4 is available and is the only remediation.
Information disclosure vulnerability in HCL Connections 8.0 allows an authenticated low-privilege user to access sensitive data through a vulnerable endpoint, requiring user interaction. No public exploit or active exploitation has been identified, and the overall risk is low.
Nomysem, an education and consulting management platform by Turkish vendor NOMYSOFT Informatics, exposes sensitive information to authenticated low-privilege users due to incompatible ACL policies that fail to properly constrain access to restricted functionality. Network-accessible endpoints can be reached by any valid account holder, yielding high-confidentiality-impact data exposure without requiring elevated rights or user interaction. No public exploit code has been identified at time of analysis; however, the vendor failed to respond to coordinated disclosure, leaving the vulnerability unpatched.
Connections versions up to 7.0 contains a vulnerability that allows attackers to obtain limited information when a single piece of internal metadata is returned (CVSS 3.5).
Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to excessive data exposure, allowing attackers to access sensitive information without proper filtering. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The Backstage Scaffolder plugin houses types and utilities for building scaffolder-related modules. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Dario Health Internet-based server infrastructure is vulnerable due to exposure of development environment details, which could lead to unsafe functionality. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM Concert 1.0.0, 1.0.1, and 1.0.2 is vulnerable to sensitive information disclosure through specially crafted API Calls. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.