CVE-2026-104617 | Medium | 5.1 | 2026-10-15 | There are two invocations of `qrencode` to display a QR code for scanning. These invocations leak the private data $pin / $key via /proc accessible for arbitra… |
CVE-2026-102944 | High | 7.5 | 2026-10-14 | cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers whe… |
CVE-2026-63160 | High | 7.4 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, making the stored value… |
CVE-2026-109953 | Medium | 5.3 | 2026-10-13 | FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credent… |
CVE-2026-108904 | Medium | 6.5 | 2026-10-11 | pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data becau… |
CVE-2026-107857 | Medium | 4.4 | 2026-10-09 | Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5, the mobile application writes the Cloud sync bearer token a… |
CVE-2026-78835 | Critical | 9.8 | 2026-10-09 | Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials. |
CVE-2026-39460 | High | 8.1 | 2026-10-09 | Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the confi… |
CVE-2026-107715 | Medium | 6.8 | 2026-10-08 | The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers to a different host… |
CVE-2026-107714 | Medium | 5.9 | 2026-10-08 | The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-orig… |
CVE-2026-107399 | Medium | 6.8 | 2026-10-08 | The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#r… |
CVE-2026-105833 | High | 7.7 | 2026-10-08 | EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Account scope access t… |
CVE-2026-107503 | | | 2026-10-08 | In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including the Ditto API URI a… |
CVE-2026-87428 | High | 7.8 | 2026-10-08 | In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored managem… |
CVE-2026-107285 | Medium | 5.9 | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16… |
CVE-2026-107282 | | | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16… |
CVE-2026-107232 | High | 7.5 | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x an… |
CVE-2026-107231 | | | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16… |
CVE-2026-76483 | Critical | 9.1 | 2026-10-07 | As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software… |
CVE-2026-105138 | Medium | 6.5 | 2026-10-07 | Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP cata… |
CVE-2026-101331 | High | 7.7 | 2026-10-07 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials. |
CVE-2026-104850 | High | 7.5 | 2026-10-06 | MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2… |
CVE-2026-105763 | Critical | 9.6 | 2026-10-06 | Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned conn… |
CVE-2026-105742 | Low | 3.7 | 2026-10-05 | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the H… |
CVE-2026-86671 | | | 2026-10-05 | In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher… |
CVE-2026-93474 | Medium | 6.5 | 2026-10-02 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-104051 | High | 8.2 | 2026-10-01 | PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader met… |
CVE-2026-103256 | High | 7.1 | 2026-10-01 | n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that se… |
CVE-2026-92537 | Medium | 5.3 | 2026-10-01 | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and inclu… |
CVE-2026-100264 | Low | 2.7 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host |
CVE-2026-100298 | High | 8.8 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are no… |
CVE-2026-81930 | Medium | 6.3 | 2026-09-29 | Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API en… |
CVE-2026-101089 | Low | 3.1 | 2026-09-27 | Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authen… |
CVE-2026-100569 | Medium | 5.5 | 2026-09-26 | OpenClaw is an npm-distributed application. In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block variables ending i… |
CVE-2026-91766 | Medium | 5.9 | 2026-09-25 | When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the… |
CVE-2026-63207 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credential… |
CVE-2026-94611 | High | 8.1 | 2026-09-24 | authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account h… |
CVE-2026-92680 | Medium | 5.5 | 2026-09-24 | Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply suff… |
CVE-2026-81208 | High | 7.7 | 2026-09-23 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials… |
CVE-2026-18124 | Medium | 6.5 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information due to insufficiently protected crede… |
CVE-2026-17643 | High | 8.8 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due… |
CVE-2026-92882 | | | 2026-09-22 | Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51 and 2.2.0 (EOL)… |
CVE-2026-49449 | Low | 2.5 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/ru… |
CVE-2026-48976 | High | 8.1 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifi… |
CVE-2026-55870 | | | 2026-09-21 | GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control… |
CVE-2026-54618 | Critical | 9.4 | 2026-09-17 | Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or… |
CVE-2026-45726 | High | 7.6 | 2026-09-17 | Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an Impor… |
CVE-2026-54617 | Critical | 9.8 | 2026-09-17 | GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request targe… |
CVE-2026-85720 | Medium | 5.9 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 a… |
CVE-2026-86862 | Medium | 6.5 | 2026-09-17 | pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql… |
CVE-2026-85719 | High | 7.5 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 a… |
CVE-2026-85717 | Medium | 6.8 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and… |
CVE-2026-89064 | Medium | 5.3 | 2026-09-17 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This i… |
CVE-2026-92759 | Medium | 6.5 | 2026-09-16 | SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password… |
CVE-2026-20234 | Critical | 9.9 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connec… |
CVE-2026-92133 | Medium | 5.4 | 2026-09-16 | Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key deriv… |
CVE-2026-92256 | Medium | 6.5 | 2026-09-15 | NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json… |
CVE-2026-76871 | Medium | 6.5 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_conf… |
CVE-2026-76859 | Medium | 6.5 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the user_pass_show.cgi component. Low-privilege attackers can e… |
CVE-2026-76857 | Medium | 6.5 | 2026-09-15 | Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddns_wan_list_show.cgi endpoint and related DDNSse… |
CVE-2026-76854 | Medium | 6.5 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7_web_auth_user_show.cgi related to captive-portal credential… |
CVE-2026-82837 | Medium | 5.3 | 2026-09-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain condit… |
CVE-2026-11921 | Critical | 9.1 | 2026-09-15 | IBM Verify Identity Access containers may not apply management password change operations correctly. |
CVE-2026-91982 | Medium | 4.3 | 2026-09-15 | Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/… |
CVE-2026-82434 | Medium | 6.5 | 2026-09-14 | Description
When ZooKeeper authentication is configured, Storm deliberately retains
`storm.zookeeper.topology.auth.payload` in the topology configuration, bec… |
CVE-2026-82433 | Medium | 6.5 | 2026-09-14 | Description
`getNimbusConf` returned the complete daemon configuration without redaction after only a user-level
authorization check. Where the cluster is con… |
CVE-2026-84179 | Medium | 6.5 | 2026-09-14 | Description
getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in th… |
CVE-2026-75015 | Medium | 4.9 | 2026-09-14 | Insufficiently Protected Credentials vulnerability in Apache Syncope.
Audit events, when sent to the configured store, are not sufficiently masked for the sen… |
CVE-2026-90895 | | | 2026-09-14 | Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsi… |
CVE-2026-82786 | Medium | 6.3 | 2026-09-14 | Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. If this vulnerability is exploited, sensitive informa… |
CVE-2026-81861 | | | 2026-09-11 | CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU function… |
CVE-2026-88013 | Low | 3.7 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attach… |
CVE-2026-81381 | Medium | 6.5 | 2026-09-08 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
CVE-2026-77909 | High | 7.7 | 2026-09-08 | Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network. |
CVE-2026-69805 | High | 7.5 | 2026-09-08 | External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-64918 | Medium | 6.5 | 2026-09-08 | Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-82070 | Medium | 6.5 | 2026-09-08 | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected… |
CVE-2026-86726 | Medium | 6.5 | 2026-09-08 | AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream… |
CVE-2026-86600 | High | 8.2 | 2026-09-08 | In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying… |
CVE-2026-61516 | Critical | 9.8 | 2026-09-08 | Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administr… |
CVE-2026-76969 | Critical | 9.4 | 2026-09-08 | @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unaut… |
CVE-2026-86175 | Medium | 6.5 | 2026-09-05 | NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission… |
CVE-2026-53603 | | | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operator_s… |
CVE-2026-85700 | Medium | 6.5 | 2026-09-04 | Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API key… |
CVE-2026-8862 | High | 7.5 | 2026-09-03 | IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the co… |
CVE-2026-75136 | Medium | 6.1 | 2026-09-02 | UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key store… |
CVE-2026-55860 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text pass… |
CVE-2026-55857 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog auth… |
CVE-2026-55856 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java app… |
CVE-2026-55854 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB… |
CVE-2026-82288 | High | 7.5 | 2026-08-28 | Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line argum… |
CVE-2026-55215 | High | 7.5 | 2026-08-28 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when… |
CVE-2026-82255 | Medium | 6.8 | 2026-08-28 | gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controll… |
CVE-2026-82247 | High | 7.5 | 2026-08-28 | gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, cont… |
CVE-2026-61802 | Medium | 6.5 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low… |
CVE-2026-73839 | Medium | 4.6 | 2026-08-28 | Administrative credentials may be exposed in plaintext within the Ebyte
device's management interface, increasing the risk of credential
compromise through v… |
CVE-2026-64632 | | | 2026-08-26 | A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account. |
CVE-2026-75960 | High | 8.1 | 2026-08-26 | Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve p… |
CVE-2026-65087 | Medium | 5.6 | 2026-08-25 | NVIDIA NemoClaw contains a vulnerability where an attacker could cause
insufficiently protected credentials . A successful exploit of this vulnerability might… |
CVE-2026-55553 | High | 7.5 | 2026-08-25 | urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows r… |