CWE-359
Exposure of Private Personal Information to an Unauthorized Actor
Monthly
Authenticated information disclosure in the Netcore NR255-V router (firmware 1.5.130703) allows any logged-in user to pull other users' session and browsing-history records by querying audit CGI components (l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and the mod_dispatch_auth/plan.json dispatch manifest). The flaw is rated 7.1 (CVSS 4.0) with PR:L/UI:N and a high confidentiality-only impact (CWE-359, exposure of private personal information), making it a privacy and data-protection problem rather than a code-execution risk. No public exploit code was identified in the supplied intelligence at time of analysis, and the issue is not listed in CISA KEV; a public disclosure writeup and a VulnCheck advisory are the primary references.
Improper state management in Apple iOS, iPadOS, and watchOS allows an installed app to track a user across other apps and websites without the user's permission, effectively defeating the platform's cross-app tracking consent controls. The flaw affects iOS/iPadOS releases before 26.7 and before 27, plus watchOS before 27, and is remediated by the iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, and watchOS 27 updates. Exploitation requires a hostile app on the device rather than remote network access; EPSS is 0.15% (5th percentile), there is no CISA KEV listing or public exploit identified, and SSVC rates exploitation as 'none' with partial technical impact.
User fingerprinting on Apple iOS and iPadOS devices running versions earlier than 26.6 allows an installed application to identify and track the device owner through sensitive data that Apple has now relocated as part of version 26.6. Per the authoritative assessment, this is an on-device, local-execution privacy flaw (CWE-359) with no additional privileges or user interaction required beyond the app running, and its impact is limited to tracking/fingerprinting rather than data theft, code execution, or system compromise; the supplied AV:N/high-confidentiality vector is not borne out by analysis. Exploitation requires getting a malicious or privacy-abusing app onto the device via the App Store, sideloading, MDM/enterprise provisioning, or TestFlight, and devices already updated to iOS/iPadOS 26.6 are not affected. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.14% (4th percentile).
Information disclosure in Firefox's Form Autofill component exposes sensitive personal data stored by the browser to unauthorized actors via a network-accessible, unauthenticated attack path scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing four separate security advisories (mfsa2026-74, mfsa2026-77, mfsa2026-78, mfsa2026-80) across release channels. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS exploitation probability stands at 0.14% (4th percentile).
Use-after-free memory corruption in Firefox's Layout: Text and Fonts component allows a remote unauthenticated attacker to achieve high-confidence confidentiality, integrity, and availability impact by luring a user to visit a malicious web page. The vulnerability spans the main Firefox release channel and all three active ESR branches (115.x, 140.x, 153.x), indicating broad exposure across enterprise and consumer deployments. No public exploit or active exploitation has been identified at time of analysis, but the network-accessible, low-complexity nature of this flaw and the breadth of MFSA advisories (mfsa2026-74 through mfsa2026-80) signal a high-priority patching target.
Information disclosure in Microsoft Remote Desktop Web Client (before 2.1.65.2) and Windows Admin Center (before 2.7.4) allows unauthenticated remote attackers to read private personal information over the network without user interaction. The CVSS 7.5 rating reflects high confidentiality impact with no integrity or availability effect. There is no public exploit identified at time of analysis, and the low EPSS score (0.55%, 42nd percentile) suggests limited near-term exploitation likelihood despite the network-reachable, unauthenticated vector.
Information disclosure in Microsoft Edge for Android (Chromium-based) allows a network-based attacker to expose a victim's private personal information, but only after luring the user into interacting with attacker-controlled content (UI:R). The flaw carries a CVSS 7.1 rating driven by high confidentiality impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. A vendor patch is available via Microsoft's MSRC update guide.
Information disclosure in Microsoft Edge for Android allows a remote unauthenticated attacker to exfiltrate private personal information over the network when a victim interacts with attacker-controlled content. The flaw carries a CVSS 7.1 with high confidentiality impact and stems from private data being exposed to an unauthorized actor (CWE-359); Microsoft has released a fix. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated attendee PII exposure in Hi.Events through 1.9.0 lets remote attackers retrieve full attendee lists — including names, emails, and personal information — by hitting the public check-in list endpoints, which treat the check-in list's short_id as the only access control. Beyond reading data, an attacker who knows or guesses a short_id can also create and delete check-in records without authentication. No public exploit identified at time of analysis; the issue was reported by VulnCheck and is tracked via an upstream GitHub fix.
Unauthenticated information disclosure in phpUploader before 2.0.2 lets remote attackers harvest the entire uploaded-files database table simply by loading any page of the application. The index model runs an unbounded SELECT and serializes the full result set into an inline JSON script block, leaking uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints. No public exploit identified at time of analysis, but the data is exposed in plain HTML source on every page, making extraction trivial; CVSS 4.0 base is 8.7 (High).
Authenticated information disclosure in the Netcore NR255-V router (firmware 1.5.130703) allows any logged-in user to pull other users' session and browsing-history records by querying audit CGI components (l7_web_auth_log_dump_cgi.c, audit_get_cgi.c, and the mod_dispatch_auth/plan.json dispatch manifest). The flaw is rated 7.1 (CVSS 4.0) with PR:L/UI:N and a high confidentiality-only impact (CWE-359, exposure of private personal information), making it a privacy and data-protection problem rather than a code-execution risk. No public exploit code was identified in the supplied intelligence at time of analysis, and the issue is not listed in CISA KEV; a public disclosure writeup and a VulnCheck advisory are the primary references.
Improper state management in Apple iOS, iPadOS, and watchOS allows an installed app to track a user across other apps and websites without the user's permission, effectively defeating the platform's cross-app tracking consent controls. The flaw affects iOS/iPadOS releases before 26.7 and before 27, plus watchOS before 27, and is remediated by the iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, and watchOS 27 updates. Exploitation requires a hostile app on the device rather than remote network access; EPSS is 0.15% (5th percentile), there is no CISA KEV listing or public exploit identified, and SSVC rates exploitation as 'none' with partial technical impact.
User fingerprinting on Apple iOS and iPadOS devices running versions earlier than 26.6 allows an installed application to identify and track the device owner through sensitive data that Apple has now relocated as part of version 26.6. Per the authoritative assessment, this is an on-device, local-execution privacy flaw (CWE-359) with no additional privileges or user interaction required beyond the app running, and its impact is limited to tracking/fingerprinting rather than data theft, code execution, or system compromise; the supplied AV:N/high-confidentiality vector is not borne out by analysis. Exploitation requires getting a malicious or privacy-abusing app onto the device via the App Store, sideloading, MDM/enterprise provisioning, or TestFlight, and devices already updated to iOS/iPadOS 26.6 are not affected. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.14% (4th percentile).
Information disclosure in Firefox's Form Autofill component exposes sensitive personal data stored by the browser to unauthorized actors via a network-accessible, unauthenticated attack path scored CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H). All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected, with Mozilla issuing four separate security advisories (mfsa2026-74, mfsa2026-77, mfsa2026-78, mfsa2026-80) across release channels. No public exploit or CISA KEV listing has been identified at time of analysis, and the EPSS exploitation probability stands at 0.14% (4th percentile).
Use-after-free memory corruption in Firefox's Layout: Text and Fonts component allows a remote unauthenticated attacker to achieve high-confidence confidentiality, integrity, and availability impact by luring a user to visit a malicious web page. The vulnerability spans the main Firefox release channel and all three active ESR branches (115.x, 140.x, 153.x), indicating broad exposure across enterprise and consumer deployments. No public exploit or active exploitation has been identified at time of analysis, but the network-accessible, low-complexity nature of this flaw and the breadth of MFSA advisories (mfsa2026-74 through mfsa2026-80) signal a high-priority patching target.
Information disclosure in Microsoft Remote Desktop Web Client (before 2.1.65.2) and Windows Admin Center (before 2.7.4) allows unauthenticated remote attackers to read private personal information over the network without user interaction. The CVSS 7.5 rating reflects high confidentiality impact with no integrity or availability effect. There is no public exploit identified at time of analysis, and the low EPSS score (0.55%, 42nd percentile) suggests limited near-term exploitation likelihood despite the network-reachable, unauthenticated vector.
Information disclosure in Microsoft Edge for Android (Chromium-based) allows a network-based attacker to expose a victim's private personal information, but only after luring the user into interacting with attacker-controlled content (UI:R). The flaw carries a CVSS 7.1 rating driven by high confidentiality impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. A vendor patch is available via Microsoft's MSRC update guide.
Information disclosure in Microsoft Edge for Android allows a remote unauthenticated attacker to exfiltrate private personal information over the network when a victim interacts with attacker-controlled content. The flaw carries a CVSS 7.1 with high confidentiality impact and stems from private data being exposed to an unauthorized actor (CWE-359); Microsoft has released a fix. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated attendee PII exposure in Hi.Events through 1.9.0 lets remote attackers retrieve full attendee lists — including names, emails, and personal information — by hitting the public check-in list endpoints, which treat the check-in list's short_id as the only access control. Beyond reading data, an attacker who knows or guesses a short_id can also create and delete check-in records without authentication. No public exploit identified at time of analysis; the issue was reported by VulnCheck and is tracked via an upstream GitHub fix.
Unauthenticated information disclosure in phpUploader before 2.0.2 lets remote attackers harvest the entire uploaded-files database table simply by loading any page of the application. The index model runs an unbounded SELECT and serializes the full result set into an inline JSON script block, leaking uploader IP addresses, Argon2ID key hashes, internal filenames, and SHA-256 fingerprints. No public exploit identified at time of analysis, but the data is exposed in plain HTML source on every page, making extraction trivial; CVSS 4.0 base is 8.7 (High).