CVE-2026-69250

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

Malicious code in babel-plugin-linaria-css-to-undefined (npm)

npm/babel-plugin-linaria-css-to-undefined is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojaniz...

EUVD-2026-52698

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request to the credential-controlled...

CVE-2026-58139

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the loadawscredentials function with the redactsecret parameter set to false, circumventing the...

CVE-2025-15544

A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related...

EUVD-2025-210608

A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related...

CVE-2026-17349 pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner

/misc/workspace/adhocconnectserver, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone, which copies every column from the source row, including userid, shared, sharedusername, and the stored credential fields...

Security Bulletin: Sterling Order Management System Software, (On prem)

Summary Multiple vulnerabilities were addressed in Sterling Order Management System Software, On prem : 10.0.2607.0-Sterling-SSFF-All-Major-Update-Installer Vulnerability Details CVEID:CVE-2026-48978 DESCRIPTION: oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client...

FortiOS - Insecure LDAP Configuration Detection

The FortiGate LDAP configuration was detected to be insecure due to missing ca-cert, secure LDAPS, or server-identity-check, potentially exposing LDAP communications to credential interception or man-in-the-middle attacks under specific network conditions. id: CVE-2019-5591 info: name: FortiOS -...

CVE-2026-8804

A flaw was found in Puppet resourceapi. This vulnerability occurs because the resource-api does not properly preserve the sensitive flag on parameters. As a result, sensitive information, such as passwords, can be stored in cleartext within the agent's local transaction state cache. This could...

CVE-2026-13444

Langflow OSS (IBM Langflow Langflow OSS) 1.0.0–1.10.1 is affected by CVE-2026-13444, allowing an attacker to access another user’s private vector documents by creating a flow with matching Chroma persist_directory and collection_name values. The attacker can see exact victim content in their work...

SUSE CVE-2026-47671

Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...

Linux Distros Unpatched Vulnerability : CVE-2026-68562

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When a...

EUVD-2021-34855

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

CVE-2021-32084

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

Xerox Printers Improper Authentication (CVE-2024-12510)

If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active LDAP setup. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Xerox Printers Missing Authentication for Critical Function (CVE-2024-12511)

With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

EUVD-2026-48744

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...

CVE-2026-55985

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...

GHSA-WFP6-F47H-HXC3 AWS CLI: Overly permissive File Permissions

Summary The AWS Command Line Interface AWS CLI is a unified tool for managing AWS services from the command line. Certain CLI subcommands wrote credential and configuration files with world-readable permissions on Unix-like systems with a default umask, allowing other local users on the same host...