CVE-2026-75137
Medium · 6.1CVSS
6.1
EPSS
0.1%
Published
Sep 2, 2026
CISA due date
—
The record
UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault data from process memory even after the application has been locked. Attackers can use the PROCESS_VM_READ permission to read the memory space of UpSignOn.exe and extract sensitive fields including entry names, URLs, usernames, passwords, TOTP secrets, and notes.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-77407 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-316
- CVE-2026-53604 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-316
- CVE-2026-75135 UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that… CWE-316
- CVE-2026-8636 IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9… CWE-316
- CVE-2026-0857 Cleartext Storage of Sensitive Information in Memory vulnerability in Mesalvo Meona… CWE-316
- CVE-2026-24319 In SAP Business One, sensitive information is written to the application�s memory dump… CWE-316
- GHSA-62vx-hpcr-m9ch @perfood/couch-auth may expose session tokens, passwords CWE-316
- CVE-2025-60794 @perfood/couch-auth may expose session tokens, passwords CWE-316