22048 matches found
CVE-2026-17349
CVE-2026-17349 affects pgAdmin 4: from version 9.0 up to, but not including, 9.17. The issue occurs in the Workspaces feature’s adhoc_connect_server when cloning an existing server via Server.clone(): the clone copies every column, including user_id, shared, shared_username, and stored credential...
CVE-2026-17349 pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner
/misc/workspace/adhocconnectserver, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone, which copies every column from the source row, including userid, shared, sharedusername, and the stored credential fields...
CVE-2026-17349 pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner
/misc/workspace/adhocconnectserver, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone, which copies every column from the source row, including userid, shared, sharedusername, and the stored credential fields...
Security Bulletin: Sterling Order Management System Software, (On prem)
Summary Multiple vulnerabilities were addressed in Sterling Order Management System Software, On prem : 10.0.2607.0-Sterling-SSFF-All-Major-Update-Installer Vulnerability Details CVEID:CVE-2026-48978 DESCRIPTION: oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client...
CVE-2026-65309
ANDRITZ HIPASE-250 formerly 250 SCALA in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords...
CVE-2026-65309
ANDRITZ HIPASE-250 formerly 250 SCALA in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords...
CVE-2026-65309
The CVE-2026-65309 entry concerns ANDRITZ HIPASE-250 (formerly 250 SCALA). Affected versions store and transmit user passwords in a reversible format rather than as a one-way hash, enabling an attacker who can access the credential store or network traffic to recover stored passwords. Reported CV...
CVE-2026-65309 Storage of passwords in a reversible format
ANDRITZ HIPASE-250 formerly 250 SCALA in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords...
EUVD-2026-51488
ANDRITZ HIPASE-250 formerly 250 SCALA in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords...
SUSE CVE-2026-17764
Inappropriate implementation in FedCM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...
SUSE CVE-2026-17792
Inappropriate implementation in Credential Management in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-8804
A flaw was found in Puppet resourceapi. This vulnerability occurs because the resource-api does not properly preserve the sensitive flag on parameters. As a result, sensitive information, such as passwords, can be stored in cleartext within the agent's local transaction state cache. This could...
PT-2026-66843
Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for...
CVE-2026-17792
An inappropriate implementation flaw was found in the Credential Management component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514019823...
CVE-2026-64816
RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...
CVE-2026-64816 RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath
RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open in lutprocessing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is...
CVE-2026-15977
SGLang contains a credential leakage vulnerability in the /serverinfo endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured...
CVE-2026-13444
Langflow OSS (IBM Langflow Langflow OSS) 1.0.0–1.10.1 is affected by CVE-2026-13444, allowing an attacker to access another user’s private vector documents by creating a flow with matching Chroma persist_directory and collection_name values. The attacker can see exact victim content in their work...