CVE-2026-72857 | High | 7.7 | 2026-08-13 | Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings an… |
CVE-2026-0290 | | | 2026-08-13 | An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a local attacker to view sensitive dat… |
CVE-2026-0289 | | | 2026-08-13 | A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a user to bypass intended security controls. |
CVE-2026-72801 | High | 7.5 | 2026-08-12 | SiYuan versions before v3.7.4 disclose encrypted-notebook key-derivation material and wrapped data keys through unauthenticated endpoints in publish mode. Atta… |
CVE-2026-72794 | High | 8.6 | 2026-08-12 | siyuan versions before v3.7.4 expose the session cookie signing key through the /api/system/getConf endpoint to unauthenticated users in publish mode. Attacker… |
CVE-2026-72793 | High | 8.6 | 2026-08-12 | SiYuan versions before v3.7.4 fail to mask sensitive configuration fields in the /api/system/getConf endpoint, allowing anonymous or publish-reader users to ob… |
CVE-2026-49349 | Medium | 6.8 | 2026-08-12 | regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A pre… |
CVE-2026-62882 | Medium | 4.3 | 2026-08-11 | Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-62839 | Medium | 6.5 | 2026-08-11 | Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. |
CVE-2026-71577 | Medium | 6.3 | 2026-08-10 | A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communica… |
CVE-2026-12984 | High | 8.2 | 2026-08-10 | Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data.
This issue affects WAH7601: through 2007… |
CVE-2026-47662 | | | 2026-08-07 | Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pa… |
CVE-2026-47660 | | | 2026-08-07 | Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pa… |
CVE-2026-21766 | Medium | 5.4 | 2026-08-05 | The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases… |
CVE-2026-71260 | Medium | 6.5 | 2026-08-05 | ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp… |
CVE-2026-52855 | Critical | 9.9 | 2026-07-31 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configura… |
CVE-2026-56570 | Low | 3.7 | 2026-07-31 | HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for… |
CVE-2026-17349 | Critical | 9.6 | 2026-07-31 | /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server… |
CVE-2026-15977 | High | 7.5 | 2026-07-30 | SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-a… |
CVE-2026-15657 | Medium | 6.5 | 2026-07-30 | A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body. |
CVE-2026-16553 | Medium | 5.4 | 2026-07-29 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain condi… |
CVE-2026-67427 | High | 8.6 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands ${env.VAR} for any hos… |
CVE-2026-67426 | Critical | 9.3 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.7, the standalone flyto-verification service in src/core/verification_s… |
CVE-2026-67425 | High | 8.6 | 2026-07-29 | Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, llm.chat reads provider keys such as OPENAI_API_KEY and ANTHROPIC_AP… |
CVE-2026-54660 | High | 7.4 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestH… |
CVE-2026-14354 | | | 2026-07-29 | CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorized credential modification, potentially… |
CVE-2026-17569 | Medium | 4.3 | 2026-07-27 | Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored… |
CVE-2026-54422 | Medium | 5.5 | 2026-07-24 | In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials u… |
CVE-2026-48022 | Medium | 6.5 | 2026-07-17 | @hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before followi… |
CVE-2026-44979 | | | 2026-07-17 | @hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie head… |
CVE-2026-16104 | Medium | 4.3 | 2026-07-17 | A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identi… |
CVE-2026-62214 | Medium | 6.5 | 2026-07-17 | OpenClaw versions before 2026.5.28 Bot Framework contains an improper input validation vulnerability that allows lower-trust callers to expose bot tokens and c… |
CVE-2026-62213 | Medium | 6.5 | 2026-07-17 | OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework… |
CVE-2026-62208 | Medium | 6.5 | 2026-07-17 | OpenClaw before 2026.6.5 could forward Authorization headers during MCP SSE redirects. When the affected feature is enabled and reachable, a lower-trust caller… |
CVE-2026-46458 | | | 2026-07-15 | ICU Scandinavia Boomerang is vulnerable to an information disclosure flaw where sensitive credential files are exposed via static HTTP. This allows an unauthen… |
CVE-2026-48295 | High | 7.5 | 2026-07-14 | CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that could result in disclosure of sensitive information. An attac… |
CVE-2026-59891 | Critical | 9.6 | 2026-07-14 | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker co… |
CVE-2026-47282 | Medium | 6.5 | 2026-07-14 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
CVE-2026-62327 | Critical | 9.1 | 2026-07-13 | 9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for… |
CVE-2026-57219 | High | 7.5 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the obsolete GET /api/auth endpoint can disclose the OAuth 2 client… |
CVE-2026-55885 | Medium | 6.8 | 2026-07-10 | Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav… |
CVE-2026-59209 | Medium | 6.5 | 2026-07-09 | n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared wor… |
CVE-2026-11827 | Medium | 4.9 | 2026-07-08 | GitLab has remediated an issue in GitLab EE affecting all versions from 9.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain condi… |
CVE-2026-59261 | High | 7.1 | 2026-07-08 | OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-tru… |
CVE-2026-56843 | Critical | 9.9 | 2026-07-08 | Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own… |
CVE-2026-55431 | High | 7.7 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `coder open app` o… |
CVE-2026-7017 | High | 7.1 | 2026-07-07 | HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.
When the server returns a 3xx redirect, `_maybe_redirec… |
CVE-2026-44938 | High | 8.8 | 2026-07-07 | A vulnerability has been identified in Fleet's agent-side deployer, which did not filter security-sensitive keys from namespaceLabels in fleet.yaml (or BundleD… |
CVE-2026-1433 | | | 2026-07-06 | uniFLOW Universal Login Manager (ULM) Standalone
contains an information disclosure vulnerability that may allow an
authenticated administrator to access sensi… |
CVE-2026-9079 | Critical | 9.8 | 2026-07-03 | libcurl had a flaw that when instructed to clear proxy authentication
credentials which made it not do so, leaving the old credentials around to get
used for s… |
CVE-2026-8926 | Critical | 9.1 | 2026-07-03 | When asking curl to use a `.netrc` file to find credentials and at the same
time specifying a URL with a username(without a password), like
`https://user@examp… |
CVE-2026-14019 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-56783 | Medium | 6.5 | 2026-06-29 | Parseable before 2.9.2 contains an information disclosure vulnerability in the notification-target API endpoints that returns webhook tokens and basic-auth cre… |
CVE-2025-7386 | Medium | 6.8 | 2026-06-29 | Information exposure vulnerability in Hitachi Storage Navigator.
This issue affects Hitachi Virtual Storage Platform 5100, 5200, 5500, 5600, 5100H, 5200H, 550… |
CVE-2026-55188 | High | 8.2 | 2026-06-26 | RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket repli… |
CVE-2026-45407 | Medium | 5.0 | 2026-06-26 | Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch command, which applies the default umask of… |
CVE-2026-44622 | Medium | 6.5 | 2026-06-25 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-55180 | Medium | 6.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace… |
CVE-2026-50017 | Medium | 6.5 | 2026-06-25 | pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-l… |
CVE-2026-9650 | High | 7.5 | 2026-06-25 | CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated atta… |
CVE-2026-32315 | Medium | 5.5 | 2026-06-24 | motionEye (mEye) is an online interface for motion software, a video surveillance program with motion detection. Versions prior to 0.44.0 create the configurat… |
CVE-2026-54276 | Medium | 6.1 | 2026-06-22 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after… |
CVE-2026-53632 | | | 2026-06-22 | launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths incl… |
CVE-2026-53840 | High | 7.1 | 2026-06-16 | OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers duri… |
CVE-2026-6517 | Medium | 6.3 | 2026-06-15 | Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop… |
CVE-2026-49949 | Medium | 5.3 | 2026-06-11 | CodexBar before 0.33.0 contains a credential forwarding vulnerability that allows network-adjacent attackers to intercept sensitive credentials by issuing cros… |
CVE-2024-45636 | Medium | 4.1 | 2026-06-11 | IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user. |
CVE-2026-41715 | Medium | 6.1 | 2026-06-09 | In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. In order for this to… |
CVE-2026-39908 | Medium | 6.5 | 2026-06-08 | OpenBullet2 through version 0.3.2 on Windows contains a credential disclosure vulnerability that allows remote attackers to capture the NTLMv2 hash of the proc… |
CVE-2026-46440 | Critical | 9.1 | 2026-06-08 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credenti… |
CVE-2026-46511 | | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token expo… |
CVE-2026-7313 | High | 8.7 | 2026-06-02 | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker… |
CVE-2026-7312 | Critical | 10.0 | 2026-06-02 | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1… |
CVE-2026-4387 | | | 2026-05-29 | StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and as… |
CVE-2026-49379 | Medium | 6.5 | 2026-05-29 | In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names |
CVE-2026-42951 | Medium | 5.4 | 2026-05-29 | An authenticated
user can download a backup of the Danelec MacGregor Voyage Data Recorder
device which includes account data and password hashes. |
CVE-2024-47271 | Medium | 4.9 | 2026-05-27 | Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote auth… |
CVE-2026-2255 | Medium | 4.3 | 2026-05-27 | Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in pla… |
CVE-2026-9395 | Low | 3.5 | 2026-05-24 | A vulnerability was identified in Besen BS20 EV Charging Station up to 20260426. Affected is an unknown function of the component BLE/UDP. The manipulation lea… |
CVE-2026-39968 | High | 7.1 | 2026-05-22 | TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the fix for GHSA-4xc5-wfwc-jw47 ("Credential Theft via Client-Side Script Execution and API Au… |
CVE-2025-13477 | High | 7.1 | 2026-05-21 | Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiB… |
CVE-2026-0393 | Medium | 6.5 | 2026-05-21 | The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to insufficient isolatio… |
CVE-2026-6345 | Medium | 6.5 | 2026-05-18 | Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker… |
CVE-2025-62312 | Low | 3.0 | 2026-05-14 | HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic authorization mechanisms may expose credenti… |
CVE-2026-6253 | Medium | 5.9 | 2026-05-13 | curl might erroneously pass on credentials for a first proxy to a second
proxy.
This can happen when the following conditions are true:
1. curl is setup to u… |
CVE-2026-43992 | Critical | 9.8 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract… |
CVE-2026-8368 | Medium | 6.5 | 2026-05-12 | LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects.
On a 3xx response, the redirect han… |
CVE-2026-45091 | Critical | 9.1 | 2026-05-12 | sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 throu… |
CVE-2026-28961 | Medium | 4.6 | 2026-05-11 | This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. An attacker with physical ac… |
CVE-2026-42869 | Critical | 10.0 | 2026-05-11 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded… |
CVE-2026-42295 | Medium | 4.9 | 2026-05-09 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, th… |
CVE-2026-41506 | Medium | 4.7 | 2026-05-08 | go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credenti… |
CVE-2025-31976 | Medium | 4.8 | 2026-05-06 | HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal appl… |
CVE-2025-62345 | Low | 2.7 | 2026-05-06 | HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability . A component contains a security weakness in its input… |
CVE-2026-23927 | | | 2026-05-06 | A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-co… |
CVE-2026-42367 | Medium | 6.5 | 2026-05-04 | A privilege escalation vulnerability exists in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request ca… |
CVE-2026-6446 | Medium | 5.4 | 2026-05-02 | The My Social Feeds – Social Feeds Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.0.4 via… |
CVE-2026-28909 | Medium | 6.5 | 2026-04-30 | Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is… |
CVE-2026-35155 | High | 7.1 | 2026-04-29 | Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. A race condition vulnerability exists that co… |
CVE-2026-7038 | Low | 3.3 | 2026-04-26 | A weakness has been identified in tufantunc ssh-mcp up to 1.5.0. Impacted is an unknown function of the file src/index.ts of the component Command Line Handler… |