PULSEUnderground Intel

LIVE13signals / 24h

FEED

ransomsilentransomgroup reclama a Reminger · DE · Professional Servicesransomincransom reclama a https://pacific-construction.com/ · GB · Manufacturingransomincransom reclama a cambrialawfirm.com · CA · Professional Servicesransomcoinbasecartel reclama a Hitachi High-Tech · JP · Manufacturingransomrhysida reclama a SIA Medical Centre · LV · Healthcareransomdragonforce reclama a GB Group S.A · PL · Financial Servicesransomqilin reclama a D & J Beverage Service · US · Hospitalityransomakira reclama a CF Supply · Retail & E-Commerceransompayload reclama a Zara Investment Holding · ES · Financial Servicesransomailock reclama a DAISEN · JP · Technologyransomailock reclama a Yaomasa · JP · Not Foundransomthegentlemen reclama a Safeware · US · Technologyransomincransom reclama a clgroup · US · Professional Servicesransomblacknevas reclama a Portable Intelligence Inc www.portable-intelligence.com serviced by an IT company Computer... · US · Technologyransomsilentransomgroup reclama a Reminger · DE · Professional Servicesransomincransom reclama a https://pacific-construction.com/ · GB · Manufacturingransomincransom reclama a cambrialawfirm.com · CA · Professional Servicesransomcoinbasecartel reclama a Hitachi High-Tech · JP · Manufacturingransomrhysida reclama a SIA Medical Centre · LV · Healthcareransomdragonforce reclama a GB Group S.A · PL · Financial Servicesransomqilin reclama a D & J Beverage Service · US · Hospitalityransomakira reclama a CF Supply · Retail & E-Commerceransompayload reclama a Zara Investment Holding · ES · Financial Servicesransomailock reclama a DAISEN · JP · Technologyransomailock reclama a Yaomasa · JP · Not Foundransomthegentlemen reclama a Safeware · US · Technologyransomincransom reclama a clgroup · US · Professional Servicesransomblacknevas reclama a Portable Intelligence Inc www.portable-intelligence.com serviced by an IT company Computer... · US · Technology

CVE WatchAug 13, 2026

CVE-2026-59503

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Act

CVSS

9.1

Critical

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Aug 13, 2026 · Last modified: Aug 13, 2026 · CWE-200

EPSS · 30d

Not enough EPSS history yet.

Technical description

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-359: Exposure of Private Personal Information to an Unauthorized Actor

Official references

www.gov.ilhttps://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-736227.5 HIG

———GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations.12h CVE-2026-736046.5 MED

———Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded passwords, cloud service account JSON with private keys, and API keys by calling this endpoint.10h CVE-2026-594998.6 HIG

——0CWE-200: Exposure of Sensitive Information to an Unauthorized Actor10h CVE-2026-73411—

——0Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : or = when applications use the escape or escapeAll APIs on Unix with shell set to dash, or with shell set to true when Dash is the default, and interpolate the result into an assignment prefixed to a command. An attacker who controls the input can supply a value such as :~ to disclose the home-directory path and may change the location on which the command operates. This issue is fixed in versions 2.1.14 and 3.0.1.1d CVE-2026-734067.5 HIG

——0Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a full PlatformUser document. An unauthenticated caller could query an email or user identifier, distinguish existing users from missing users, and obtain tenant identifiers, user identifiers, email addresses, SSO identifiers, and document revision metadata. This issue is fixed in version 3.39.32.10h CVE-2026-733085.7 MED

——0Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast BuilderSocketEvent.AutomationTestProgress to the app room, and stored progress in packages/server/src/automations/testProgress.ts without user scoping. A co-builder could receive or poll another SSO-authenticated builder test and obtain OAuth2 access and refresh tokens. The fix adds sanitizeAutomationTestResult and isolates progress by user. This issue is fixed in version 3.39.25.1d