CVE-2026-66822

MediumCVSS 5.9/10Last modified Oct 22, 2026

Description

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-201

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 22, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-668249.2A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture CVE-2026-668256.9Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, CVE-2026-668296.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker CVE-2026-66834.6FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to be zero during write/CVE-2026-668326.5When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as CVE-2026-668358.2Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected CVE-2026-668378.7Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache ThriftCVE-2026-668388.2Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex allows SQL InjectCVE-2026-668398.4NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). An auCVE-2026-66844.6FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived from GPT header fieldCVE-2026-668408.7XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system informaCVE-2026-668428.8BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed
CVE-2026-66822: Medium severity, CVSS 5.9 | Vulnix