CVE-2026-19750 | High | 8.1 | 2026-08-13 | A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executi… |
CVE-2026-11552 | Medium | 5.3 | 2026-06-08 | A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System and Syllabus-aligned Learning Management and Examination System… |
CVE-2026-11515 | Medium | 5.3 | 2026-06-08 | A vulnerability has been found in SourceCodester Barangay Resident Profiling and Information Management System 1.0. The impacted element is an unknown function… |
CVE-2026-6597 | Low | 2.7 | 2026-04-20 | A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_terms of the file src/backend/base/langflo… |
CVE-2026-4251 | Low | 2.5 | 2026-03-16 | A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of the file resources/a… |
CVE-2026-4250 | Low | 2.5 | 2026-03-16 | A vulnerability was found in Albert Sağlık Hizmetleri ve Ticaret Albert Health up to 1.7.3 on Android. Affected is an unknown function of the file resources/as… |
CVE-2026-4243 | Low | 2.5 | 2026-03-16 | A weakness has been identified in La Nacion App 10.2.25 on Android. This impacts an unknown function of the file source/app/lanacion/clublanacion/BuildConfig.j… |
CVE-2026-4242 | Low | 2.5 | 2026-03-16 | A security flaw has been discovered in BabyChakra Pregnancy & Parenting App up to 5.4.3.0 on Android. This affects an unknown function of the file file app/bab… |
CVE-2026-4217 | Low | 2.5 | 2026-03-16 | A security vulnerability has been detected in XREAL Nebula App up to 3.2.1 on Android. This impacts an unknown function of the file in ai/nreal/nebula/flutterP… |
CVE-2025-15151 | Low | 3.7 | 2025-12-28 | A vulnerability was determined in TaleLin Lin-CMS up to 0.6.0. This affects an unknown part of the file /tests/config.py of the component Tests Folder. This ma… |
CVE-2025-15128 | Medium | 5.3 | 2025-12-28 | A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint… |
CVE-2025-14183 | Medium | 4.3 | 2025-12-07 | A vulnerability was found in SGAI Space1 NAS N1211DS up to 1.0.915. This issue affects the function GET_FACTORY_INFO/GET_USER_INFO of the file /cgi-bin/JSONAPI… |
CVE-2025-13221 | Medium | 5.3 | 2025-11-15 | A weakness has been identified in Intelbras UnniTI 24.07.11. The affected element is an unknown function of the file /xml/sistema/usuarios.xml. Executing manip… |
CVE-2025-13187 | Medium | 5.3 | 2025-11-14 | A security vulnerability has been detected in Intelbras ICIP 2.0.20. Affected is an unknown function of the file /xml/sistema/acessodeusuario.xml. Such manipul… |
CVE-2025-11666 | Medium | 6.7 | 2025-10-13 | A flaw has been found in Tenda RP3 Pro up to 22.5.7.93. This impacts an unknown function of the file force_upgrade.sh of the component Firmware Update Handler… |
CVE-2025-11649 | High | 7.0 | 2025-10-12 | A vulnerability was found in Tomofun Furbo 360 and Furbo Mini. The affected element is an unknown function of the component Root Account Handler. Performing ma… |
CVE-2025-11284 | High | 7.3 | 2025-10-05 | A vulnerability has been found in Zytec Dalian Zhuoyun Technology Central Authentication Service 3. Affected by this vulnerability is an unknown functionality… |
CVE-2025-9725 | Low | 2.5 | 2025-08-31 | A vulnerability was identified in Cudy LT500E up to 2.3.12. Affected is an unknown function of the file /squashfs-root/etc/shadow of the component Web Interfac… |
CVE-2025-7577 | Low | 3.7 | 2025-07-14 | A vulnerability was found in Teledyne FLIR FB-Series O and FLIR FH-Series ID 1.3.2.16. It has been classified as problematic. This affects an unknown part. The… |
CVE-2025-7453 | Low | 3.7 | 2025-07-11 | A vulnerability was found in saltbo zpan up to 1.6.5/1.7.0-beta2. It has been rated as problematic. This issue affects the function NewToken of the file zpan/i… |
CVE-2025-7080 | Low | 3.7 | 2025-07-06 | A vulnerability, which was classified as problematic, was found in Done-0 Jank up to 322caebbad10568460364b9667aa62c3080bfc17. Affected is an unknown function… |
CVE-2025-7079 | Low | 3.7 | 2025-07-06 | A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the fil… |
CVE-2025-6932 | Low | 3.7 | 2025-06-30 | A vulnerability, which was classified as problematic, was found in D-Link DCS-7517 up to 2.02.0. This affects the function g_F_n_GenPassForQlync of the file /b… |
CVE-2025-6139 | Low | 3.9 | 2025-06-16 | A vulnerability, which was classified as problematic, has been found in TOTOLINK T10 4.1.8cu.5207. Affected by this issue is some unknown functionality of the… |
CVE-2025-4286 | Low | 2.7 | 2025-05-05 | A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Disposi… |
CVE-2025-2555 | Low | 2.9 | 2025-03-20 | A vulnerability classified as problematic has been found in Audi Universal Traffic Recorder App 2.0. Affected is an unknown function of the component FTP Crede… |
CVE-2025-2355 | Low | 3.3 | 2025-03-17 | A vulnerability was found in BlackVue App 3.65 on Android and classified as problematic. Affected by this issue is some unknown functionality of the component… |
CVE-2021-37000 | High | 7.7 | 2024-12-28 | Some Huawei wearables have a permission management vulnerability. |
CVE-2024-11026 | Low | 3.7 | 2024-11-08 | A vulnerability was found in Intelligent Apps Freenow App 12.10.0 on Android. It has been rated as problematic. Affected by this issue is some unknown function… |
CVE-2021-28509 | Medium | 6.1 | 2022-05-26 | This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport proto… |
CVE-2021-28508 | Medium | 6.8 | 2022-05-26 | This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport proto… |
CVE-2022-25327 | Medium | 5.5 | 2022-02-25 | The PAM module for fscrypt doesn't adequately validate fscrypt metadata files, allowing users to create malicious metadata files that prevent other users from… |
CVE-2020-8968 | High | 7.1 | 2021-12-17 | Parallels Remote Application Server (RAS) allows a local attacker to retrieve certain profile password in clear text format by uploading a previously stored cy… |
CVE-2021-22568 | High | 8.8 | 2021-12-09 | When using the dart pub publish command to publish a package to a third-party package server, the request would be authenticated with an oauth2 access_token th… |
CVE-2021-21522 | High | 8.2 | 2021-09-28 | Dell BIOS contains a Credentials Management issue. A local authenticated malicious user may potentially exploit this vulnerability to gain access to sensitive… |
CVE-2021-28499 | Medium | 6.3 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user account passwords set in clear text could leak to users… |
CVE-2021-28498 | High | 8.7 | 2021-09-09 | In Arista's MOS (Metamako Operating System) software which is supported on the 7130 product line, user enable passwords set in clear text could result in unpri… |
CVE-2021-1522 | Medium | 4.3 | 2021-08-04 | A vulnerability in the change password API of Cisco Connected Mobile Experiences (CMX) could allow an authenticated, remote attacker to alter their own passwor… |
CVE-2021-21505 | High | 8.0 | 2021-05-06 | Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011, contain an undocumented default iDRAC account. A remote unauthenticated attacke… |
CVE-2020-24680 | High | 7.0 | 2020-12-22 | In S+ Operations and S+ Historian, the passwords of internal users (not Windows Users) are encrypted but improperly stored in a database. |
CVE-2020-3140 | Critical | 9.8 | 2020-07-16 | A vulnerability in the web management interface of Cisco Prime License Manager (PLM) Software could allow an unauthenticated, remote attacker to gain unauthori… |
CVE-2020-10287 | Critical | 9.8 | 2020-07-15 | The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documente… |
CVE-2020-1978 | Medium | 5.8 | 2020-04-08 | TechSupport files generated on Palo Alto Networks VM Series firewalls for Microsoft Azure platform configured with high availability (HA) inadvertently collect… |
CVE-2019-1950 | High | 8.4 | 2020-02-19 | A vulnerability in Cisco IOS XE SD-WAN Software could allow an unauthenticated, local attacker to gain unauthorized access to an affected device. The vulnerabi… |
CVE-2019-7488 | Critical | 9.8 | 2019-12-23 | Weak default password cause vulnerability in SonicWall Email Security appliance which leads to attacker gain access to appliance database. This vulnerability a… |
CVE-2018-7820 | Critical | 9.8 | 2019-09-17 | A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to b… |
CVE-2016-10791 | Medium | 5.3 | 2019-08-06 | cPanel before 60.0.15 does not ensure that system accounts lack a valid password, so that logins are impossible (CPANEL-9559). |
CVE-2017-18470 | High | 8.8 | 2019-08-05 | cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196). |
CVE-2016-10821 | Medium | 6.5 | 2019-08-01 | In cPanel before 55.9999.141, Scripts/addpop reveals a command-line password in a process list (SEC-75). |
CVE-2019-5456 | High | 8.1 | 2019-07-30 | SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version <= 5.10.21 and their actual SMTP server to record th… |
CVE-2019-13560 | Critical | 9.8 | 2019-07-11 | D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to force a blank password via the apply_sec.cgi setup_wizard parameter. |
CVE-2017-8229 | Critical | 9.8 | 2019-07-03 | Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials. If the firmware version V2.420… |
CVE-2017-9326 | High | 7.5 | 2019-07-03 | The keystore password for the Spark History Server may be exposed in unsecured files under the /var/run/cloudera-scm-agent directory managed by Cloudera Manage… |
CVE-2017-6900 | Critical | 9.8 | 2019-07-03 | An issue was discovered in Riello NetMan 204 14-2 and 15-2. The issue is with the login script and wrongpass Python script used for authentication. When callin… |
CVE-2017-8417 | High | 8.8 | 2019-07-02 | An issue was discovered on D-Link DCS-1100 and DCS-1130 devices. The device requires that a user logging into the device provide a username and password. Howev… |
CVE-2017-10718 | Medium | 6.5 | 2019-06-17 | Recently it was discovered as a part of the research on IoT devices in the most recent firmware for Shekar Endoscope that any malicious user connecting to the… |
CVE-2017-9385 | Critical | 9.8 | 2019-06-17 | An issue was discovered on Vera Veralite 1.7.481 devices. The device has an additional OpenWRT interface in addition to the standard web interface which allows… |
CVE-2019-4381 | Medium | 5.5 | 2019-06-14 | IBM i 7.27.3 Clustering could allow a local attacker to obtain sensitive information, caused by the use of advanced node failure detection using the REST API t… |
CVE-2017-13717 | High | 8.8 | 2019-06-10 | Starry Station (aka Starry Router) sets the Access-Control-Allow-Origin header to "*". This allows any hosted file on any domain to make calls to the device's… |
CVE-2018-7788 | Medium | 6.5 | 2019-05-22 | A CWE-255 Credentials Management vulnerability exists in Modicon Quantum with firmware versions prior to V2.40. which could cause a Denial Of Service when usin… |
CVE-2016-7043 | Medium | 5.9 | 2019-05-15 | It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deplo… |
CVE-2019-7690 | Critical | 9.8 | 2019-05-13 | In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the lifetime of the proce… |
CVE-2019-1714 | High | 8.6 | 2019-05-03 | A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 Single Sign-On (SSO) for Clientless SSL VPN (WebVPN) and AnyConnect Remo… |
CVE-2015-1320 | Medium | 5.5 | 2019-04-22 | The SeaMicro provisioning of Ubuntu MAAS logs credentials, including username and password, for the management interface. This issue affects Ubuntu MAAS versio… |
CVE-2019-1654 | High | 7.8 | 2019-04-17 | A vulnerability in the development shell (devshell) authentication for Cisco Aironet Series Access Points (APs) running the Cisco AP-COS operating system could… |
CVE-2017-6047 | Critical | 9.8 | 2019-04-02 | Detcon Sitewatch Gateway, all versions without cellular, Passwords are presented in plaintext in a file that is accessible without authentication. |
CVE-2010-5305 | Critical | 9.8 | 2019-03-26 | The potential exists for exposure of the product's password used to restrict unauthorized access to Rockwell PLC5/SLC5/0x/RSLogix 1785-Lx and 1747-L5x controll… |
CVE-2014-5433 | Critical | 9.8 | 2019-03-26 | An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on Baxter SIGMA Spectrum I… |
CVE-2017-17836 | Critical | 9.8 | 2019-01-23 | In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An att… |
CVE-2018-6443 | High | 8.1 | 2019-01-22 | A vulnerability in Brocade Network Advisor Versions before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss Administration interfa… |
CVE-2015-9278 | Critical | 9.8 | 2019-01-16 | MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB after a password-cha… |
CVE-2018-15719 | Critical | 9.8 | 2018-12-12 | Open Dental before version 18.4 installs a mysql database and uses the default credentials of "root" with a blank password. This allows anyone on the network w… |
CVE-2008-7320 | Medium | 6.8 | 2018-11-18 | GNOME Seahorse through 3.30 allows physically proximate attackers to read plaintext passwords by using the quickAllow dialog at an unattended workstation, if t… |
CVE-2018-15389 | Critical | 9.8 | 2018-10-05 | A vulnerability in the install function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the administr… |
CVE-2003-1605 | High | 7.5 | 2018-08-23 | curl 7.x before 7.10.7 sends CONNECT proxy credentials to the remote server. |
CVE-2016-8616 | Low | 3.7 | 2018-08-01 | A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the exist… |
CVE-2016-9489 | High | 8.8 | 2018-07-13 | In ManageEngine Applications Manager 12 and 13 before build 13200, an authenticated user is able to alter all of their own properties, including own group, i.e… |
CVE-2016-6554 | Critical | 9.8 | 2018-07-13 | Synology NAS servers DS107, firmware version 3.1-1639 and prior, and DS116, DS213, firmware versions prior to 5.2-5644-1, use non-random default credentials of… |
CVE-2016-6553 | Critical | 9.8 | 2018-07-13 | Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses non-random default credentials of: admin:admin and localdisplay:111111. A remote network attack… |
CVE-2016-6552 | Critical | 9.8 | 2018-07-13 | Green Packet DX-350 uses non-random default credentials of: root:wimax. A remote network attacker can gain privileged access to a vulnerable device. |
CVE-2016-6551 | Critical | 9.8 | 2018-07-13 | Intellian Satellite TV antennas t-Series and v-Series, firmware version 1.07, uses non-random default credentials of: ftp/ftp or intellian:12345678. A remote n… |
CVE-2016-6547 | High | 7.8 | 2018-07-13 | The Zizai Tech Nut mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. |
CVE-2016-6546 | High | 7.8 | 2018-07-13 | The iTrack Easy mobile application stores the account password used to authenticate to the cloud API in base64-encoding in the cache.db file. The base64 encodi… |
CVE-2013-2951 | High | 7.8 | 2018-07-11 | IBM WebSphere Portal 7.0.0.x and 8.0.0.x write passwords to a trace file when tracing is enabled for the Selfcare Portlet (Profile Management), which allows lo… |
CVE-2016-6538 | High | 8.8 | 2018-07-06 | The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 fo… |
CVE-2018-0319 | Critical | 9.8 | 2018-06-07 | A vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unaut… |
CVE-2018-0318 | Critical | 9.8 | 2018-06-07 | A vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gain unauthor… |
CVE-2016-10526 | High | 8.6 | 2018-05-31 | A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In… |
CVE-2015-9240 | High | 7.5 | 2018-05-29 | Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct passwor… |
CVE-2018-0226 | High | 7.5 | 2018-05-02 | A vulnerability in the assignment and management of default user accounts for Secure Shell (SSH) access to Cisco Aironet 1800, 2800, and 3800 Series Access Poi… |
CVE-2013-5461 | High | 8.8 | 2018-04-27 | IBM Endpoint Manager for Remote Control 9.0.0 and 9.0.1 and Tivoli Remote Control 5.1.2 store multiple hashes of partial passwords, which makes it easier for r… |
CVE-2014-0872 | Medium | 4.1 | 2018-04-25 | The installation process in IBM Security Key Lifecycle Manager 2.5 stores unencrypted credentials, which might allow local users to obtain sensitive informatio… |
CVE-2014-6111 | High | 7.8 | 2018-04-20 | IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS… |
CVE-2016-9593 | Medium | 4.7 | 2018-04-16 | foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file would be able to view p… |
CVE-2016-8366 | High | 7.3 | 2018-04-05 | Webvisit in Phoenix Contact ILC PLCs offers a password macro to protect HMI pages on the PLC against casual or coincidental opening of HMI pages by the user. T… |
CVE-2016-0898 | Critical | 10.0 | 2018-03-29 | MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component l… |
CVE-2014-4861 | Critical | 9.8 | 2018-03-09 | The Remote Desktop Launcher in Thycotic Secret Server before 8.6.000010 does not properly cleanup a temporary file that contains an encrypted password once a s… |
CVE-2016-3952 | High | 7.8 | 2018-02-06 | web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/templat… |
CVE-2015-4400 | Medium | 4.6 | 2018-02-06 | Ring (formerly DoorBot) video doorbells allow remote attackers to obtain sensitive information about the wireless network configuration by pressing the set up… |
CVE-2014-1835 | High | 7.8 | 2018-02-02 | The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table. |