CVE-2026-111946None▾ SunlitPlack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header. When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header.
When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size. Clients receiving affected responses may use the disclosed inode numbers to aid backend fingerprinting and correlation of files served through different URLs.
Plack-Middleware-ETag >= 0.04 < 0.06Upgrade to Plack-Middleware-ETag 0.06 or later. Where the file_etag option is set, remove the use of "inode".
For deployments that cannot upgrade to 0.06, where the file_etag option is set, remove the use of "inode". If the file_etag option is not specified, change it to ["mtime", "size"].
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-110855Medium· 6.5GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url()…
CVE-2026-110466Medium· 4.3Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability
CVE-2026-97740Medium· 6.5Exposure of sensitive system information to an unauthorized control sphere in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
CVE-2026-96948Medium· 5.5Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.
CVE-2026-96935Medium· 5.5Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to disclose information locally.
CVE-2026-96865Medium· 5.6Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.