CVE-2026-17570

CVE-2026-17570 : Improper access control in the PAM password history endpoints of Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. Affected: Devolutions Server 2026.2.4.0–2026.2.12.0 and 2026.1.23.0 and earlier. CVSS...

EUVD-2026-49380

Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server 2026.1.23.0...

CVE-2026-17570

Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server 2026.1.23.0...

CVE-2026-17570

Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server 2026.1.23.0...

Siemens SIMATIC S7-1500 CPU 1518 MFP Plaintext Storage of a Password (CVE-2026-23370)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505620; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Linux Distros Unpatched Vulnerability : CVE-2026-59847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an...

CVE-2026-61886

Weintek cMT3092X HMI stores user account passwords in plaintext...

CVE-2026-61886

Weintek cMT3092X HMI is affected by CVE-2026-61886 due to plaintext storage of user account passwords. The vulnerability resides in how credentials are stored, enabling potential exposure of confidential data. Affected component: Weintek cMT3092X HMI (password storage mechanism). Root cause: plai...

CVE-2026-61886 Weintek cMT3092X Plaintext Storage of a Password

Weintek cMT3092X HMI stores user account passwords in plaintext...

CVE-2026-61886

Weintek cMT3092X HMI stores user account passwords in plaintext...

GHSA-PVCR-8MVP-W8QR Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)

Summary The Budibase AI chat-link handoff flow GET/POST /api/chat-links/:instance/:token/handoff binds an external chat identity Slack/Discord/MS Teams/Telegram to a Budibase user account. The confirmation endpoint is on a public route no CSRF middleware, no auth-group gate and the only credentia...

EUVD-2026-48445

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...

PT-2026-64424

Name of the Vulnerable Software and Affected Versions Weintek cMT3092X affected versions not specified Description The HMI stores user account passwords in plaintext, which allows an attacker with access to the storage to retrieve sensitive credentials. Recommendations At the moment, there is no...

CVE-2026-40430

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...

CVE-2026-40430

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...

CVE-2026-40430

Pronetiqs IntraVUE is affected. Versions 3.2.1a14 and earlier store passwords in plaintext, exposure of cleartext credentials via the API. Root cause is plaintext credential storage; impact is potential credential disclosure through API access. No exploitation details are provided in the document...

CVE-2026-40430 Plaintext Storage of a Password in Panduit IntraVUE by Pronetiqs

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...

CVE-2026-47755

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal wit...

CVE-2026-47755

CVE-2026-47755 : ITFlow prior to v26.05 is vulnerable to authenticated cross-tenant credential disclosure. A low-privileged authenticated agent can fetch plaintext credentials and TOTP secrets of another client by loading the credential edit modal for an arbitrary credential_id due to missing cli...

USN-8601-1 pam vulnerability

It was discovered that PAM had a timing discrepancy in the pamuserdb module when comparing plaintext passwords. An attacker could possibly use this issue to obtain sensitive information by measuring response-timing differences during repeated authentication attempts...