CVE-2026-117619

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...

CVE-2026-117619

Jenkins versions 2.587 and earlier (including LTS 2.580.1 and earlier ) are vulnerable to an insufficient session expiration flaw (CVE-2026-117619 ). The root cause is that requests authenticated via HTTP Basic authentication , including those using API tokens , can result in the acquisition of a...

PT-2026-128307

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.587 Jenkins LTS versions prior to 2.580.1 Description Requests authenticated via HTTP Basic authentication, including those using an API token, can be used to obtain a remember-me cookie. This allows an attacker who...

Insufficient session expiration vulnerability

Jenkins's "Keep me signed in" feature uses a persistent cookie, known as the "remember me" cookie, to re-authenticate users without requiring them to enter credentials again. The validity of this cookie does not depend on the credentials used to obtain it. Jenkins 2.587 and earlier, LTS 2.580.1 a...

CVE-2026-117619: Undefined Security Weakness

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after t...

Jenkins security vulnerabilities

Security vulnerabilities exist in Jenkins versions 2.587 and earlier, as well as LTS 2.580.1 and earlier. These vulnerabilities arise because requests using HTTP Basic authentication—including those containing an API token—can result in the acquisition of a “remember me” cookie. As a consequence,...

curl: CURL_NETRC_REQUIRED sends the URL password when the .netrc file has no matching entry

Summary In required netrc mode CURLNETRCREQUIRED, as set by --netrc or --netrc-file, the CURLOPTNETRC documentation says any credential information present in the URL is ignored, but when the configured .netrc file loads successfully yet has no entry matching the requested host and username,...

CVE-2026-114221

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in use...

Information Exposure

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Information Exposure via the Uri class in system/src/Grav/Common/Uri.php, which populates the user and password properties from the request's...

EUVD-2026-108004

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in use...

CVE-2026-114221 NewType Infortech｜NT OneAPP - Credential Disclosure

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in use...

CVE-2026-114221

The NT OneAPP software developed by NewType Infortech contains a Credential Disclosure vulnerability. Under specific conditions, unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source within the WebView . This flaw allows attackers to obtain...

CVE-2026-114221 NewType Infortech｜NT OneAPP - Credential Disclosure

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in use...

PT-2026-121261

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in use...

NewType Infortech NT OneAPP trust management issue vulnerability

NewType Infortech NT OneAPP versions 1.5.22 and earlier contain a trust management vulnerability. This vulnerability arises because WebView fails to validate origins; as a result, an HTTP Basic Authentication query is triggered, potentially allowing unauthenticated remote attackers to obtain the...

CVE-2026-114470 Cross-Site Request Forgery (CSRF) in hMailServer

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

CVE-2026-114470

Progressive Robot hMailServer versions 6.0.0 through 6.3.6 are vulnerable to a Cross-Site Request Forgery (CSRF) in the REST API . The root cause is that while the API protects cookie-based sessions, it does not apply the same protections to HTTP Basic authentication . Because browsers cache Basi...

CVE-2026-114470 Cross-Site Request Forgery (CSRF) in hMailServer

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

EUVD-2026-107313

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...

CVE-2026-114470 Cross-Site Request Forgery (CSRF) in hMailServer

Cross-site request forgery in the REST API of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote attacker to make an authenticated user's browser perform a state-changing request. The REST API accepts HTTP Basic authentication and answers a browser with a Basic sign-in box; a brows...