CVE-2026-100264 | Low | 2.7 | 2026-09-30 | In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host |
CVE-2026-100298 | High | 8.8 | 2026-09-29 | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are no… |
CVE-2026-81930 | Medium | 6.3 | 2026-09-29 | Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API en… |
CVE-2026-101089 | Low | 3.1 | 2026-09-27 | Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authen… |
CVE-2026-100569 | Medium | 5.5 | 2026-09-26 | OpenClaw is an npm-distributed application. In versions >= 2026.4.25 and < 2026.8.1, the workspace environment-variable filter did not block variables ending i… |
CVE-2026-91766 | Medium | 5.9 | 2026-09-25 | When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the… |
CVE-2026-63207 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credential… |
CVE-2026-94611 | High | 8.1 | 2026-09-24 | authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account h… |
CVE-2026-92680 | Medium | 5.5 | 2026-09-24 | Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply suff… |
CVE-2026-81208 | High | 7.7 | 2026-09-23 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials… |
CVE-2026-18124 | Medium | 6.5 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information due to insufficiently protected crede… |
CVE-2026-17643 | High | 8.8 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due… |
CVE-2026-92882 | | | 2026-09-22 | Insufficiently protected credentials in the host and folder configuration endpoints of the REST API in Checkmk <2.5.0p15, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL)… |
CVE-2026-49449 | Low | 2.5 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. From 1.4.0 until 3.7.2, packages/renderer/MdToHtml/ru… |
CVE-2026-48976 | High | 8.1 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifi… |
CVE-2026-55870 | | | 2026-09-21 | GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portion of source control… |
CVE-2026-54618 | Critical | 9.4 | 2026-09-17 | Obsidian Web MCP is a secure remote MCP server for Obsidian vaults. Prior to 0.2.0, /oauth/authorize issues an authorization code without a login, consent, or… |
CVE-2026-45726 | High | 7.6 | 2026-09-17 | Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an Impor… |
CVE-2026-54617 | Critical | 9.8 | 2026-09-17 | GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request targe… |
CVE-2026-85720 | Medium | 5.9 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 a… |
CVE-2026-86862 | Medium | 6.5 | 2026-09-17 | pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql… |
CVE-2026-85719 | High | 7.5 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 a… |
CVE-2026-85717 | Medium | 6.8 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and… |
CVE-2026-89064 | Medium | 5.3 | 2026-09-17 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This i… |
CVE-2026-92759 | Medium | 6.5 | 2026-09-16 | SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password… |
CVE-2026-20234 | Critical | 9.9 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connec… |
CVE-2026-92133 | Medium | 5.4 | 2026-09-16 | Jenkins GitLab Plugin 1.2149.vcfc32c82b_f7f and earlier caches the GitLab API client built for alternative GitLab API token credentials under a cache key deriv… |
CVE-2026-92256 | Medium | 6.5 | 2026-09-15 | NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_vpn_remote/plan.json… |
CVE-2026-76871 | Medium | 6.5 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cgi, pptp_client_conf… |
CVE-2026-76859 | Medium | 6.5 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the user_pass_show.cgi component. Low-privilege attackers can e… |
CVE-2026-76857 | Medium | 6.5 | 2026-09-15 | Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddns_wan_list_show.cgi endpoint and related DDNSse… |
CVE-2026-76854 | Medium | 6.5 | 2026-09-15 | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l7_web_auth_user_show.cgi related to captive-portal credential… |
CVE-2026-82837 | Medium | 5.3 | 2026-09-15 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain condit… |
CVE-2026-11921 | Critical | 9.1 | 2026-09-15 | IBM Verify Identity Access containers may not apply management password change operations correctly. |
CVE-2026-91982 | Medium | 4.3 | 2026-09-15 | Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/… |
CVE-2026-82434 | Medium | 6.5 | 2026-09-14 | Description
When ZooKeeper authentication is configured, Storm deliberately retains
`storm.zookeeper.topology.auth.payload` in the topology configuration, bec… |
CVE-2026-82433 | Medium | 6.5 | 2026-09-14 | Description
`getNimbusConf` returned the complete daemon configuration without redaction after only a user-level
authorization check. Where the cluster is con… |
CVE-2026-84179 | Medium | 6.5 | 2026-09-14 | Description
getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in th… |
CVE-2026-75015 | Medium | 4.9 | 2026-09-14 | Insufficiently Protected Credentials vulnerability in Apache Syncope.
Audit events, when sent to the configured store, are not sufficiently masked for the sen… |
CVE-2026-90895 | | | 2026-09-14 | Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsi… |
CVE-2026-82786 | Medium | 6.3 | 2026-09-14 | Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*. If this vulnerability is exploited, sensitive informa… |
CVE-2026-81861 | | | 2026-09-11 | CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU function… |
CVE-2026-88013 | Low | 3.7 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attach… |
CVE-2026-81381 | Medium | 6.5 | 2026-09-08 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
CVE-2026-77909 | High | 7.7 | 2026-09-08 | Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network. |
CVE-2026-69805 | High | 7.5 | 2026-09-08 | External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-64918 | Medium | 6.5 | 2026-09-08 | Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-82070 | Medium | 6.5 | 2026-09-08 | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insufficiently protected… |
CVE-2026-86726 | Medium | 6.5 | 2026-09-08 | AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream… |
CVE-2026-86600 | High | 8.2 | 2026-09-08 | In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying… |
CVE-2026-61516 | Critical | 9.8 | 2026-09-08 | Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administr… |
CVE-2026-76969 | Critical | 9.4 | 2026-09-08 | @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unaut… |
CVE-2026-86175 | Medium | 6.5 | 2026-09-05 | NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission… |
CVE-2026-53603 | | | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operator_s… |
CVE-2026-85700 | Medium | 6.5 | 2026-09-04 | Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API key… |
CVE-2026-8862 | High | 7.5 | 2026-09-03 | IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the co… |
CVE-2026-75136 | Medium | 6.1 | 2026-09-02 | UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key store… |
CVE-2026-55860 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text pass… |
CVE-2026-55857 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog auth… |
CVE-2026-55856 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java app… |
CVE-2026-55854 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB… |
CVE-2026-82288 | High | 7.5 | 2026-08-28 | Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line argum… |
CVE-2026-55215 | High | 7.5 | 2026-08-28 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when… |
CVE-2026-82255 | Medium | 6.8 | 2026-08-28 | gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controll… |
CVE-2026-82247 | High | 7.5 | 2026-08-28 | gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, cont… |
CVE-2026-61802 | Medium | 6.5 | 2026-08-28 | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low… |
CVE-2026-73839 | Medium | 4.6 | 2026-08-28 | Administrative credentials may be exposed in plaintext within the Ebyte
device's management interface, increasing the risk of credential
compromise through v… |
CVE-2026-64632 | | | 2026-08-26 | A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account. |
CVE-2026-75960 | High | 8.1 | 2026-08-26 | Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve p… |
CVE-2026-65087 | Medium | 5.6 | 2026-08-25 | NVIDIA NemoClaw contains a vulnerability where an attacker could cause
insufficiently protected credentials . A successful exploit of this vulnerability might… |
CVE-2026-55553 | High | 7.5 | 2026-08-25 | urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows r… |
CVE-2026-76846 | High | 7.5 | 2026-08-25 | Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attack… |
CVE-2026-76839 | Medium | 6.5 | 2026-08-25 | Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field… |
CVE-2026-78555 | | | 2026-08-24 | RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shorte… |
CVE-2026-71511 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to… |
CVE-2026-71862 | High | 7.5 | 2026-08-21 | Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful… |
CVE-2026-71494 | | | 2026-08-21 | Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Te… |
CVE-2026-55765 | High | 8.5 | 2026-08-20 | CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartex… |
CVE-2026-50192 | | | 2026-08-20 | Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials… |
CVE-2026-53586 | Medium | 6.5 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your a… |
CVE-2026-20359 | Critical | 9.9 | 2026-08-19 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal se… |
CVE-2026-8810 | Medium | 6.9 | 2026-08-19 | On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables. |
CVE-2026-53456 | | | 2026-08-18 | Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in cust… |
CVE-2026-53454 | | | 2026-08-18 | Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper stor… |
CVE-2026-62684 | Low | 2.7 | 2026-08-18 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, the… |
CVE-2026-15806 | | | 2026-08-18 | The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not tak… |
CVE-2026-23922 | Medium | 4.9 | 2026-08-18 | The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were ma… |
CVE-2026-57485 | High | 8.5 | 2026-08-17 | Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in… |
CVE-2026-14564 | Critical | 9.0 | 2026-08-17 | Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded S… |
CVE-2026-72857 | High | 7.7 | 2026-08-13 | Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings an… |
CVE-2026-0290 | Medium | 5.5 | 2026-08-13 | An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a local attacker to view sensitive dat… |
CVE-2026-0289 | Medium | 6.5 | 2026-08-13 | A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a user to bypass intended security controls. |
CVE-2026-72801 | High | 7.5 | 2026-08-12 | SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthenticated endpoints in publish mode. Atta… |
CVE-2026-72794 | High | 8.6 | 2026-08-12 | siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attacker… |
CVE-2026-72793 | High | 8.6 | 2026-08-12 | SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to ob… |
CVE-2026-49349 | Medium | 6.8 | 2026-08-12 | regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A pre… |
CVE-2026-62882 | Medium | 4.3 | 2026-08-11 | Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-62839 | Medium | 6.5 | 2026-08-11 | Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-71577 | Medium | 6.3 | 2026-08-10 | A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communica… |
CVE-2026-12984 | High | 8.2 | 2026-08-10 | Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data.
This issue affects WAH7601: through 2007… |