CVE-2026-57500
REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authen
CVSS
6.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 11, 2026 · Last modified: Nov 11, 2026 · CWE-200
Not enough EPSS history yet.
REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-126920——
———Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)2hCVE-2026-126882——
———Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)2hCVE-2026-126878——
———Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)2hCVE-2026-126327——
———Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API.3hCVE-2026-0331——
———An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated remote attacker with network access to obtain sensitive firewall and session information by sending traffic to or through a dataplane interface.
Panorama is not affected by this vulnerability.5hCVE-2026-1238292.5 LOW—
———A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x.6h