CVE-2026-86443 Cleartext Storage of Sensitive Information Vulnerability

Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the device to retrieve the credentials stored by the application and impersonate the user account...

CVE-2026-86443 Cleartext Storage of Sensitive Information Vulnerability

Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the device to retrieve the credentials stored by the application and impersonate the user account...

CVE-2026-86443

DuoxMe for Android, in versions prior to 4.3.4 , stores sensitive credentials in cleartext , allowing an attacker with local access to the device to retrieve them and impersonate the user account . The CNA-assigned CVSS 4.0 score is 6.9 (MEDIUM) (AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/SC:H/VI:N/SI:H/VA:N/...

EUVD-2026-80326

Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the device to retrieve the credentials stored by the application and impersonate the user account...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to insecure storage of sensitive information (CVE-2023-29261)

Summary IBM Sterling Secure Proxy could allow a local user with specific information about the system to obtain privileged information due to inadequate memory clearing during operations and the CVE is addressed in version 6.2.2.0 Vulnerability Details CVEID:CVE-2023-29261 DESCRIPTION: IBM Sterli...

PT-2026-93948

MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical access to the device can extract this material from an SPI flash dump, without authenticating to the device and without knowledge of the...

CVE-2025-56566

MikroTik firmware 7.19.4 is vulnerable because it stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical access to the device can extract this information by performing an SPI flash dump . This extraction can be completed ...

CVE-2025-56565

DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within non-volatile memory. The exposed material includes SSH private keys, dynamic DNS passwords, email notification credentials and administrative passwords. An...

PT-2026-93672

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the usb-storage module specifically affecting ene ub6250. The ene ub6250 probe function calls usb stor probe2, which schedules delayed scan work. Subsequently,...

CVE-2025-56566

MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical access to the device can extract this material from an SPI flash dump, without authenticating to the device and without knowledge of the...

PT-2026-93664

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A null pointer dereference exists in the fsg common set num buffers function within the usb gadget mass storage module. This occurs when the kstrtou8 function returns a value of 0 or 1 f...

EUVD-2025-210924

MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical access to the device can extract this material from an SPI flash dump, without authenticating to the device and without knowledge of the...

CVE-2025-56566

MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical access to the device can extract this material from an SPI flash dump, without authenticating to the device and without knowledge of the...

CVE-2026-77407: Cleartext Storage of Sensitive Information in Memory

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those...

CVE-2026-90031: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb-storage: eneub6250: fix race between scan work and probe eneub6250probe calls usbstorprobe2, which starts the usb-storage infrastructure and schedules the delayed scan work. The driver then calls enegetcardtype, which sends a...

CVE-2026-90029: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: storage: realtekcr: fix use-after-free on disconnect realtekcrdestructor calls timerdelete before the chip containing the timer is freed. The timer callback may still be running and can rearm itself, resulting in a...

CVE-2026-86443: Cleartext Storage of Sensitive Information

Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the device to retrieve the credentials stored by the application and impersonate the user account...

CVE-2025-56565: Cleartext Storage of Sensitive Information

DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within non-volatile memory. The exposed material includes SSH private keys, dynamic DNS passwords, email notification credentials and administrative passwords. An...

PT-2026-93670

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the realtek cr USB storage component. The realtek cr destructor function calls timer delete before the chip containing the timer is freed. This allows th...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38557)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. There is an access control vulnerability in TOTOLINK T6. This vulnerability stems from incorrect access control in the setStorageCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST request...