CVE-2026-75135

The record

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master password and decrypt vault contents by reading a retained backup key from the process memory of UpSignOn.exe, even after the vault has been re-locked. Attackers can extract the backup key from process memory to decrypt the encrypted master password backup stored in v6-vault1.DATA.txt, then use the recovered master password to decrypt the main vault and export all password manager entries in cleartext.

Affected packages

Related vulnerabilities

• CVE-2026-77407 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-316
• CVE-2026-53604 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-316
• CVE-2026-75137 UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that… CWE-316
• CVE-2026-8636 IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9… CWE-316
• CVE-2026-0857 Cleartext Storage of Sensitive Information in Memory vulnerability in Mesalvo Meona… CWE-316
• CVE-2026-24319 In SAP Business One, sensitive information is written to the application�s memory dump… CWE-316
• GHSA-62vx-hpcr-m9ch @perfood/couch-auth may expose session tokens, passwords CWE-316
• CVE-2025-60794 @perfood/couch-auth may expose session tokens, passwords CWE-316