CVE-2026-67383
Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a netw
CVSS
6.5
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Sep 8, 2026 · Last modified: Sep 8, 2026 · CWE-209
Not enough EPSS history yet.
Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-696845.5 MED—
———Generation of error message containing sensitive information in Windows Error Reporting allows an authorized attacker to disclose information locally.6hCVE-2026-695525.7 MED—
———Generation of error message containing sensitive information in Windows Print Spooler Components allows an authorized attacker to disclose information over a network.6hCVE-2026-692945.5 MED—
———Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally.6hCVE-2026-688865.5 MED—
———Use after free in Windows Network Connection Broker allows an authorized attacker to disclose information locally.6hCVE-2026-118736.5 MED25.0%
——8An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification resource exhaustion vector (disk growth and I/O contention) without requiring authentication.7dCVE-2026-82739—2.6%
——1Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.
Ash.Resource.Validation.Confirm's atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field's current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.
This issue affects ash: from 2.17.20 before 3.32.2.7d