CVE-2026-82181
Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtai
CVSS
5.5
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Aug 28, 2026 · Last modified: Aug 28, 2026 · CWE-598
Not enough EPSS history yet.
Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-761799.8 CRI—
——0An improper protection of authentication tokens vulnerability exists in
certain Ebyte gateway products. Authentication tokens used by the web
management interface are insufficiently protected during client-side
session handling, which may allow an attacker with access to exposed
session information to obtain and reuse a valid token. Successful
exploitation could allow an attacker to impersonate an authenticated
user and gain unauthorized access to device management functionality.14hCVE-2026-634087.5 HIG28.8%
——9Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.9dCVE-2026-748809.8 CRI22.9%
——7openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.12dCVE-2026-668326.5 MED17.0%
——5When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.17dCVE-2026-148387.4 HIG10.8%
——3Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking.
This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.3dCVE-2026-477685.5 MED1.3%
——0nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, newly-minted operator API key exposed in redirect URL (Referer, history, proxy logs). This issue has been patched in version 0.3.2.30d