CVE-2026-124037
An information exposure flaw in the public access-list sign-up feature of the Flock Safety Platform, present from 2026-06-23 to 2026-10-22,
CVSS
5.9
Medium
EPSS
0.4%
p36
KEV
—
Exploit Today
11
0-100
Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-359
Not enough EPSS history yet.
An information exposure flaw in the public access-list sign-up feature of the Flock Safety Platform, present from 2026-06-23 to 2026-10-22, allowed a remote, unauthenticated attacker who had a community's public sign-up link and a registered vehicle's license plate to retrieve that registrant's name, email address, home address and approval status. Each lookup required solving a CAPTCHA. No license plate reader detections, images or video were exposed. Flock remediated the issue in the hosted service on 2026-10-22; no customer action is required.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1218767.9 HIG—
———A flaw was found in the interaction between systemd-gpt-auto-generator and
confidential computing guest VM images in OpenShift Sandboxed Containers
(confidential peer pods). systemd-gpt-auto-generator automatically discovers
and mounts GPT partitions by type GUID at boot with no user confirmation. In
the confidential computing threat model, where the host/hypervisor is the
adversary, a malicious host can inject partitions into the guest's virtual
disk. Most critically, injecting a swap partition causes the guest kernel to
page out TEE-encrypted memory to a host-controlled block device, breaking the
confidentiality guarantee of the hardware TEE (AMD SEV-SNP, Intel TDX).
The PodVM images use a GPT-partitioned disk with dm-verity on the root
partition. However, the roothash= kernel parameter only disables root
auto-discovery — non-root partitions (swap, /home, /var, /srv, /var/tmp) are
still auto-discovered and mounted. The generator is shipped unmasked in the
RHEL systemd-udev subpackage, and no kernel command line parameter in the
measured UKI addon disables it. Additionally, the PodVM measurement script
captures PCRs 3, 9, 11, and 12, but not PCR 5 (GPT partition table), so
partition table modifications are not detected by remote attestation.2hCVE-2026-835284.9 MED59.4%
——18Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information.2dCVE-2026-111753—45.7%
——14Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.34 and 21.0.3, the @angular/common HttpClient function xsrfInterceptorFn uses a regular expression that does not normalize request URLs in the same way as the browser's WHATWG URL parser. With XSRF protection enabled, a mutating HTTP request to an attacker-controlled URL containing backslashes, stripped control characters or spaces, or removable ASCII whitespace can be misclassified as relative and same-origin, causing the interceptor to attach the X-XSRF-TOKEN header before the browser dispatches the request to a cross-origin host. With permissive CORS handling for the custom header, the attacker can obtain the victim's XSRF token and use it to perform cross-site request forgery against the victim session. This issue is fixed in versions 20.3.34 and 21.0.3.3dCVE-2026-541446.1 MED42.9%
——13OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0 on macOS, the runtime injected into a supported remote account webview such as Google Meet allows page JavaScript to call getDisplayMedia without a live user gesture. Instead of rejecting the request, the shim falls through to native Chromium capture behavior, and the embedded CEF environment can auto-select the primary display because it lacks the normal desktop-media picker. If OpenHuman already has macOS Screen Recording permission and an attacker obtains JavaScript execution in an allowed embedded origin, the attacker can obtain a real desktop capture stream without a new user gesture. The stream can expose chats, documents, source code, email, meeting content, credentials, one-time codes, and other visible desktop information. The separate direct screen_share_begin_session IPC path failing origin validation does not prevent exploitation through getDisplayMedia. This issue is fixed in version 0.56.0.6dCVE-2026-859166.2 MED37.2%
——11Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.27dCVE-2026-1025794.3 MED13.6%
——4A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.42d