CVE-2026-1642 NGINX vulnerability

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with a man-in-the-middle MITM position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data in...

CVE-2026-1642

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with a man-in-the-middle MITM position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data in...

K000159824: NGINX vulnerability CVE-2026-1642

Security Advisory Description A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with a man-in-the-middle MITM position on the upstream server side—along with conditions beyond the attacker's control—may be abl...

CVE-2025-65924

ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically hyperlinks in fields that are intended for plain text. Although JavaScript is blocked preventing XSS, the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable...

CVE-2020-37093

Netis E1+ 1.2.32533 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve WiFi passwords through the netcoreget.cgi endpoint. Attackers can send a GET request to the endpoint to extract sensitive network credentials including SSID and WiFi passwords in...

CVE-2025-65924

ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically hyperlinks in fields that are intended for plain text. Although JavaScript is blocked preventing XSS, the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable...

CVE-2025-12773

CVE-2025-12773 involves a vulnerability in the Brocade SANnav product where the script update-reports-purge-settings.sh logs can include the SANnav database password in system audit logs on versions before 2.4.0a. The issue allows a remote authenticated attacker with audit-log access to retrieve ...

CVE-2025-65924

ERPNext versions up to and including 15.88.1 are vulnerable to a flaw where the system fails to sanitize or remove hyperlinks in fields intended for plain text. This vulnerability specifically affects the Add Quality Goal function. While JavaScript is blocked to prevent XSS, the malicious HTML i...

EUVD-2025-206723

ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically hyperlinks in fields that are intended for plain text. Although JavaScript is blocked preventing XSS, the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable...

CVE-2025-65924

ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically hyperlinks in fields that are intended for plain text. Although JavaScript is blocked preventing XSS, the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable...

PT-2026-5952

ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically hyperlinks in fields that are intended for plain text. Although JavaScript is blocked preventing XSS, the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable...

rustfs 日志信息泄露漏洞

RustFS is a high-performance object storage system developed by RustFS. Versions of RustFS from alpha.13 to alpha.81 have a vulnerability related to log information leakage. This vulnerability stems from storing sensitive credentials as plain-text records in application logs, which can lead to...

PT-2026-6192

Name of the Vulnerable Software and Affected Versions Shenzhen Tenda AC7 firmware versions prior to V03.03.03.01 cn Description The firmware for Shenzhen Tenda AC7 devices up to version V03.03.03.01 cn reveals account credentials in plain text within HTTP responses. This allows an attacker...

Tenda AC7 安全漏洞

Tenda AC7 is a wireless router produced by the Chinese company Tenda. Versions of Tenda AC7 such as V03.03.03.01cn and earlier contain security vulnerabilities. These vulnerabilities stem from HTTP responses that expose account credentials in plain text, potentially allowing access to sensitive...

CVE-2025-65924

ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically hyperlinks in fields that are intended for plain text. Although JavaScript is blocked preventing XSS, the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable...

CVE-2025-65924

ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically hyperlinks in fields that are intended for plain text. Although JavaScript is blocked preventing XSS, the HTML is still preserved in the generated PDF document. As a result, an attacker can inject malicious clickable...

CVE-2025-59105

With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as "/etc/passwd", as well as stored certificates, cryptographic keys, stored PINs and so on can be modified and...

Tenda W30E security vulnerabilities

The Tenda W30E is a router produced by the Chinese company Tenda. Versions of the Tenda W30E such as V2 and V16.01.0.195037 have security vulnerabilities. These vulnerabilities stem from the maintenance interface, which exposes sensitive credentials in plain text, potentially allowing network...

ROS-20260126-73-0054

A vulnerability in the pgAdmin 4 database management tool is related to mismanagement of code generation. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code when restoring data from PLAIN files...

Saleor security vulnerabilities

Saleor is an open-source interface software developed by Saleor Commerce. Versions 3.2.0 to 3.20.109, 3.21.0-a.0 to 3.21.44, and 3.22.0-a.0 to 3.22.28 of Saleor contain security vulnerabilities. These vulnerabilities stem from insecure direct object references, which may allow unverified...