CVE-2026-81861: Insufficiently Protected Credentials

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality...

CVE-2026-38058: Exposure of Sensitive System Information to an Unauthorized Control Sphere

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them...

ROS-20260911-73-0206

The vulnerability of Digital Credentials components in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a malicious actor to cause service interruptions through a specially created HTML page...

PT-2026-89892

Name of the Vulnerable Software and Affected Versions SCADAPack 47x affected versions not specified SCADAPack 47xi affected versions not specified SCADAPack 47xd affected versions not specified SCADAPack 470R affected versions not specified SCADAPack 57x affected versions not specified SCADAPack...

CVE-2026-79396

Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over...

CVE-2026-79396

Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over...

PT-2026-90047

Name of the Vulnerable Software and Affected Versions Xiongmai IP Camera XM530 versions prior to HMT.CM2005-v220608.1837 Description The device uses hardcoded default credentials that are stored in unencrypted plaintext within the bin/config.xml file and compiled into the Sofia executable. This...

CVE-2026-85083: Use of Hard-coded Credentials

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially...

EUVD-2026-76189

Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over...

PT-2026-90516

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A deployment mode designed to provide read-only access to stored data fails to restrict request methods on certain application programming interface routes. This...

PT-2026-90514

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An API endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store without restricting its...

PT-2026-90507

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 29.0.3 Description Tokens obtained through delegated authentication methods, including EC2 credentials, application credentials, OAuth1 access tokens, and trusts, are not restricted from creating, modifying...

CVE-2026-82583: Improper Neutralization of Special Elements used in an SQL Command

NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...

CVE-2026-90451: Use of Default Credentials

An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled packet-analysis component. A deployment that copies this example file into active configuration without running the setup routine that regenerates the value...

CVE-2026-79396

The Xiongmai IP Camera XM530 is vulnerable to unauthorized access due to the use of hardcoded default credentials in firmware versions HMT.CM2005-v220608.1837 and earlier. Static account credentials are stored in unencrypted plaintext within the bin/config.xml file and are also compiled into the ...

axios: Axios: Information disclosure of proxy credentials via HTTP redirects

A flaw was found in Axios, a promise-based HTTP client, specifically in its Node.js HTTP adapter. When Axios is configured to use an authenticated proxy and follows a redirect, it may inadvertently send the Proxy-Authorization header, containing proxy credentials, to the redirect target. This can...

axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...

CVE-2026-78573

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

CVE-2026-78573

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

CVE-2026-78573 IBM ContextForge MCP Gateway is affected by use of default credentials

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...