CVE-2026-109460
Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to dis
CVSS
5.5
Medium
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-200
Not enough EPSS history yet.
Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disclose information locally.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-961565.5 MED—
——0Use of uninitialized resource in Windows Broker Infrastructure Service allows an authorized attacker to disclose information locally.4hCVE-2026-125329——
——0Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including the viewer role, when a task has a linked Gitea issue or pull request. The plaintext integration.config contains the Gitea accessToken and webhookSecret, allowing the token's granted Gitea actions and forged webhook deliveries that pass HMAC verification. GitHub integrations and installations without a configured Gitea integration are not affected. This issue is fixed in version 2.13.0.4hCVE-2026-33563——
——0Exposure of sensitive information to an unauthorized actor for some Intel(R) Platform Monitoring Technology (Intel(R) PMT) software before version 3.2.0.22 within Ring 3: User Applications may allow an information disclosure. System software adversary with an authenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.6hCVE-2026-1249444.3 MED—
——0Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.4hCVE-2026-1249414.3 MED—
——0Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.4hCVE-2026-1249304.3 MED—
——0Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, and Thunderbird 160.4h