CVE-2026-126817
A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryp
CVSS
6.5
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 13, 2026 · Last modified: Nov 13, 2026 · CWE-312
Not enough EPSS history yet.
A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryption to be written and stored as cleartext when more than one model is mapped onto the same storage location. No error or warning is raised. A party holding an ordinary read-only database account, with no access to the encryption key material, may then obtain those values in clear form.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1164314.3 MED—
——0Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.10hCVE-2026-1266436.5 MED—
——0A cleartext storage flaw was found in the AAP Gateway Operator. When reconciling an AutomationController, the operator reads the protected resource-server Secret (Secret/<aap-name>-resource-server, key controller_resource_server_secret) and copies its plaintext value into the generated AutomationController custom resource under spec.extra_settings (RESOURCE_SERVER.SECRET_KEY). Although the operator uses no_log to keep the value out of its own logs, serializing it into the custom resource exposes it to any principal able to read the AutomationController CR without permission to read the backing Kubernetes Secret, breaking the expected OpenShift RBAC separation between the two resources. The value may also propagate into Kubernetes API/etcd storage, GitOps and Argo diffs and history, rendered manifests, support bundles, and audit data. The resource-server secret is intended for trusted Gateway-to-Controller service authentication, and its disclosure may allow a user to impersonate a trusted Controller service and reach privileged service-index APIs.2dCVE-2026-126328—2.4%
——1Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses.2dCVE-2026-1058136.3 MED2.0%
——1Cleartext storage of sensitive information in Ivanti UWM before version 2026.4 allows a local authenticated attacker to retrieve another local user's session token.1dCVE-2026-1153407.1 HIG0.2%
——0Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.1dCVE-2026-112168—0.0%
——0The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets.1d