CWE-538
Insertion of Sensitive Information into Externally-Accessible File
Monthly
Qexo instances running versions 4.0.0 through any release before 4.2.0 expose the /api/init_step/ initialization endpoint without authentication or a setup-completion guard, allowing an unauthenticated attacker who supplies a CSRF token harvested from any public page of the instance to restart the setup flow and, in the same interaction, read back stored PROVIDER configuration such as service credentials. The CNA rates this 9.3 (Critical, CVSS 4.0) while our independent CVSS 3.1 assessment scores it AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting that the integrity impact is a forced re-entry into initialization rather than arbitrary data modification, and that the confidentiality loss only materializes on instances that have already stored provider secrets (for example a Vercel token or image-bed credentials). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in Qexo 4.2.0.
Sensitive information disclosure in Red Hat OpenShift AI's vllm-orchestrator-gateway component exposes bearer tokens and full chat payloads because the production binary writes all incoming Authorization headers and complete request bodies to persistent logs. Any user holding logging privileges can read these logs to harvest live credentials and potentially PII-laden conversation content. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Sensitive information disclosure in Apache Airflow versions prior to 3.2.2 exposes JWT authentication tokens via KubernetesExecutor command-line arguments, allowing low-privileged users with process listing access on worker pods to harvest credentials and impersonate workers against the Execution API. The flaw, addressed in PR #60108 alongside a redesign of workload/execution token lifetimes, carries a CVSS 8.8 due to high impact across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and EPSS sits at 0.02%, suggesting limited mass-exploitation activity.
Privilege escalation in the Apache Airflow CNCF Kubernetes provider (versions before 10.17.0) exposes worker JWT tokens to any principal holding read-only access to Kubernetes Pods. When Airflow runs with the KubernetesExecutor, the scheduler embeds a 'workload'-scoped Execution API JWT in the pod's workload payload, so a low-privileged user who can read pod objects can harvest that token and impersonate a running task via the Task SDK, including actions that mutate Airflow database state. There is no public exploit identified at time of analysis; EPSS is 0.01% (2nd percentile) and CISA SSVC rates exploitation as none, so this is an insider/lateral-movement risk rather than a mass-exploited flaw.
Local privilege escalation in Veeam Backup & Replication on Windows enables authenticated users to gain system-level access without user interaction. An attacker with local account credentials can exploit this vulnerability to achieve complete control over the backup infrastructure, including reading, modifying, or deleting backups. No patch is currently available for this high-severity issue affecting backup administrators and organizations relying on Veeam for data protection.
Elastic Cloud Enterprise stores runtime information about its platform service containers - including secrets drawn from those containers' configuration, such as role tokens - in a location that lower-privileged platform components can read, so an attacker who already controls such a component can retrieve those secrets. Possession of a role token then allows the attacker to register an unauthorized host into the installation carrying that token's roles, which is where the integrity impact comes from. Exposure is confined to adjacent-network access from inside the ECE platform and requires a high-privileged internal foothold (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H as assessed; the CVE record publishes AC:H), so this is a post-access escalation primitive rather than an internet-facing remote flaw; no public exploit code has been identified and there is no CISA KEV entry. Fixed builds are ECE 3.8.6 and 4.2.1 per the vendor's ESA-2026-218 advisory.
Privilege escalation in Elastic Cloud Enterprise lets an attacker who already controls a host in an ECE installation leverage secrets left behind by certificate rotation to gain full control of the ECE control plane and its managed deployments. The retained rotation data includes platform credentials and certificate authority private keys, and lower-privileged platform components can read it; exploitation therefore requires a prior host foothold and prior execution of the rotation procedure. No public exploit identified at time of analysis, and the vendor fixed the issue in ECE 3.8.6 and 4.2.1.
Information disclosure in the WP Desk ShopMagic WooCommerce plugin (versions through 4.9.1) allows remote attackers to retrieve embedded sensitive data from an externally accessible file or directory, with confidentiality-only impact rated Low. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the issue can be reached over the network without authentication or user interaction, and the plugin is a WordPress/WooCommerce automation tool, so exposed site data may be at risk. This is a moderate-severity disclosure flaw rather than a top-tier priority; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, with a this_month priority label.
Unauthenticated file and directory existence disclosure in light0011 CMS (commits c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930) allows remote attackers to probe the filesystem through the Uploadify check-exists.php endpoint by controlling the filename argument. Publicly available exploit code exists, and the vendor has not responded to the issue report; CISA KEV does not list this CVE. Despite a CVSS 4.0 score of 6.9, our assessment scores it 5.3 because the flaw only reveals existence metadata-no file contents, write access, or availability impact.
The clevis-luks-pkcs11-askpin helper shipped with Red Hat Enterprise Linux (7, 8, 9 and 10) and Red Hat OpenShift Container Platform 4 writes the PKCS#11 token PIN in cleartext to a file that is not given restrictive permissions, so under the default process umask the file is world-readable, and the file is also not reliably removed when the decryption script exits early, leaving the PIN readable indefinitely. The issue is assessed as CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning an authenticated local user with low privileges can obtain high-confidentiality secret material, but only on systems that actually use the non-default clevis PKCS#11 pin for LUKS unlocking. No public exploit code was identified at time of analysis and there is no CISA KEV listing; exploitation is local-only and the practical risk is confidentiality loss of the token PIN rather than a remote or code-execution threat.
Qexo instances running versions 4.0.0 through any release before 4.2.0 expose the /api/init_step/ initialization endpoint without authentication or a setup-completion guard, allowing an unauthenticated attacker who supplies a CSRF token harvested from any public page of the instance to restart the setup flow and, in the same interaction, read back stored PROVIDER configuration such as service credentials. The CNA rates this 9.3 (Critical, CVSS 4.0) while our independent CVSS 3.1 assessment scores it AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting that the integrity impact is a forced re-entry into initialization rather than arbitrary data modification, and that the confidentiality loss only materializes on instances that have already stored provider secrets (for example a Vercel token or image-bed credentials). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in Qexo 4.2.0.
Sensitive information disclosure in Red Hat OpenShift AI's vllm-orchestrator-gateway component exposes bearer tokens and full chat payloads because the production binary writes all incoming Authorization headers and complete request bodies to persistent logs. Any user holding logging privileges can read these logs to harvest live credentials and potentially PII-laden conversation content. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Sensitive information disclosure in Apache Airflow versions prior to 3.2.2 exposes JWT authentication tokens via KubernetesExecutor command-line arguments, allowing low-privileged users with process listing access on worker pods to harvest credentials and impersonate workers against the Execution API. The flaw, addressed in PR #60108 alongside a redesign of workload/execution token lifetimes, carries a CVSS 8.8 due to high impact across confidentiality, integrity, and availability. No public exploit has been identified at time of analysis and EPSS sits at 0.02%, suggesting limited mass-exploitation activity.
Privilege escalation in the Apache Airflow CNCF Kubernetes provider (versions before 10.17.0) exposes worker JWT tokens to any principal holding read-only access to Kubernetes Pods. When Airflow runs with the KubernetesExecutor, the scheduler embeds a 'workload'-scoped Execution API JWT in the pod's workload payload, so a low-privileged user who can read pod objects can harvest that token and impersonate a running task via the Task SDK, including actions that mutate Airflow database state. There is no public exploit identified at time of analysis; EPSS is 0.01% (2nd percentile) and CISA SSVC rates exploitation as none, so this is an insider/lateral-movement risk rather than a mass-exploited flaw.
Local privilege escalation in Veeam Backup & Replication on Windows enables authenticated users to gain system-level access without user interaction. An attacker with local account credentials can exploit this vulnerability to achieve complete control over the backup infrastructure, including reading, modifying, or deleting backups. No patch is currently available for this high-severity issue affecting backup administrators and organizations relying on Veeam for data protection.
Elastic Cloud Enterprise stores runtime information about its platform service containers - including secrets drawn from those containers' configuration, such as role tokens - in a location that lower-privileged platform components can read, so an attacker who already controls such a component can retrieve those secrets. Possession of a role token then allows the attacker to register an unauthorized host into the installation carrying that token's roles, which is where the integrity impact comes from. Exposure is confined to adjacent-network access from inside the ECE platform and requires a high-privileged internal foothold (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H as assessed; the CVE record publishes AC:H), so this is a post-access escalation primitive rather than an internet-facing remote flaw; no public exploit code has been identified and there is no CISA KEV entry. Fixed builds are ECE 3.8.6 and 4.2.1 per the vendor's ESA-2026-218 advisory.
Privilege escalation in Elastic Cloud Enterprise lets an attacker who already controls a host in an ECE installation leverage secrets left behind by certificate rotation to gain full control of the ECE control plane and its managed deployments. The retained rotation data includes platform credentials and certificate authority private keys, and lower-privileged platform components can read it; exploitation therefore requires a prior host foothold and prior execution of the rotation procedure. No public exploit identified at time of analysis, and the vendor fixed the issue in ECE 3.8.6 and 4.2.1.
Information disclosure in the WP Desk ShopMagic WooCommerce plugin (versions through 4.9.1) allows remote attackers to retrieve embedded sensitive data from an externally accessible file or directory, with confidentiality-only impact rated Low. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the issue can be reached over the network without authentication or user interaction, and the plugin is a WordPress/WooCommerce automation tool, so exposed site data may be at risk. This is a moderate-severity disclosure flaw rather than a top-tier priority; no public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, with a this_month priority label.
Unauthenticated file and directory existence disclosure in light0011 CMS (commits c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930) allows remote attackers to probe the filesystem through the Uploadify check-exists.php endpoint by controlling the filename argument. Publicly available exploit code exists, and the vendor has not responded to the issue report; CISA KEV does not list this CVE. Despite a CVSS 4.0 score of 6.9, our assessment scores it 5.3 because the flaw only reveals existence metadata-no file contents, write access, or availability impact.
The clevis-luks-pkcs11-askpin helper shipped with Red Hat Enterprise Linux (7, 8, 9 and 10) and Red Hat OpenShift Container Platform 4 writes the PKCS#11 token PIN in cleartext to a file that is not given restrictive permissions, so under the default process umask the file is world-readable, and the file is also not reliably removed when the decryption script exits early, leaving the PIN readable indefinitely. The issue is assessed as CVSS 3.1 4.7 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning an authenticated local user with low privileges can obtain high-confidentiality secret material, but only on systems that actually use the non-default clevis PKCS#11 pin for LUKS unlocking. No public exploit code was identified at time of analysis and there is no CISA KEV listing; exploitation is local-only and the practical risk is confidentiality loss of the token PIN rather than a remote or code-execution threat.