{"affected":[{"defaultStatus":"unknown","product":"iDentalSoft","source":"CNA: cisa-cg","vendor":"iDentalSoft","versions":[{"lessThan":"14.0.3","status":"affected","version":"0","versionType":"custom"},{"status":"unaffected","version":"14.0.3"}]}],"cveId":"CVE-2026-126091","cwes":["CWE-538"],"description":"Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: cisa-cg","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},{"score":8.7,"severity":"high","source":"CNA: cisa-cg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N","version":"4.0"}],"modifiedAt":1794594776261,"publishedAt":1794589904088,"references":[{"source":"CNA: cisa-cg","tags":["third-party-advisory"],"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-314-01.json"},{"source":"CNA: cisa-cg","tags":["vdb-entry"],"url":"https://www.cve.org/CVERecord?id=CVE-2026-126091"}],"remediation":[],"revision":"a21312e34964f0a21541abd950c94450ccd36f9a670d0c232b17ec864749f7d5","sources":[{"modifiedAt":1794594776261,"name":"CNA: cisa-cg","retrievedAt":1794597869733,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126091"}],"ssvc":{"assessedAt":1792611760462,"automatable":"yes","exploitation":"none","source":"CNA: cisa-cg","technicalImpact":"partial"},"status":"published","title":"iDentalSoft website information exposure","updatedAt":1794597869733}