CVE-2026-105763 Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL

Twenty is an open-source CRM customer relationship management platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords,...

CVE-2018-13341

CVE-2018-13341 Esta herramienta tiene como objetivo explotar el CVE-2018-13341. Usando la dirección MAC del dispositivo objetivo, se puede recuperar la contraseña de la cuenta oculta "crengsuperuser" , que tiene privilegios elevados y permite ejecutar comandos SUDO. El Protocolo de la Caja de...

cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure

CVE-2026-34474: Fuga de secreto en ZTE H298A / H108N a través de ETHCheat Desglose técnico de CVE-2026-34474, donde una solicitud no autenticada ETHCheat=1 provoca que los routers ZTE ZXHN H298A 1.1 y H108N 2.6 afectados devuelvan la contraseña de administrador activa, el ESSID y la PSK de WLAN e...

CVE-2023-6421

CVE-2023-6421 Download Manager 3.2.83 - Filtración de contraseñas de descarga de archivos protegidos sin autenticación Descripción El plugin no protege las contraseñas de descarga de archivos, filtrándolas al recibir una inválida POC python3 CVE-2023-6421.py https://kubernetes.docker.internal No...

CVE-2026-89012

CVE-2026-89012 — Omisión de la lista de denegación del filtro SQL de Dolibarr Exploit para CVE-2026-89012: la lista de denegación de campos prohibidos en forgeSQLFromUniversalSearchCriteria introducida con la corrección de CVE-2026-71510 utiliza un inarray sensible a mayúsculas y minúsculas...

CVE-2026-94593

The Armatura One software contains a vulnerability where the backup and restore routine records the full database connection command in a host log file. This includes the superuser password in plain text . If an attacker gains access to the server operating system, they can use these disclosed cr...

CVE-2026-104055 Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

Komfy-Switch-Wifi-Password-Disclosure

Komfy-Switch-Wifi-Password-Disclosure Introducción Este writeup detallará mi hallazgo en el Komfy Switch with Camera de D-Link para recuperar el SSID y la contraseña wifi asociados al dispositivo a través de bluetooth 4.0 BLE. El Komfy switch es un producto de seguridad y automatización para el...

Rocky Linux 8 [CIQ] Security Update: gnome-shell / gnome-shell-debuginfo / gnome-shell-debugsource (crlsa-2022_1814)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221814 advisory. gnome-shell: Password from logged-out user may be shown on login screen CVE-2020-17489 Tenable has extracted the preceding description block directly from the CIQ...

CVE-2026-103548

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

Joomla! Webservice - Password Disclosure

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. id: CVE-2023-23752 info: name: Joomla! Webservice - Password Disclosure author: badboycxcc,Sascha Brendel severity: medium description: | An issue was discovered in...

PT-2026-103525

Name of the Vulnerable Software and Affected Versions Itron MV-90 xi version 3.0 Description Passwords and password histories are stored improperly in the configuration file, allowing attackers to decode them and gain unauthorized access to the MV-90 application as any user. Recommendations At th...

EUVD-2026-87837

AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/id/vue/profile endpoint that allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. Attackers with View-only access can call this...

PT-2026-99471

Name of the Vulnerable Software and Affected Versions AzuraCast versions prior to 0.23.8 Description Broken access control allows authenticated users with only View Station Page permission to read Icecast/Shoutcast admin, source, and relay passwords. By calling the 'GET /api/station/id/vue/profil...

CVE-2026-4638 Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor

PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG...

CVE-2026-4638 Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor

PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG...

CVE-2026-4638

PRTG Network Monitor versions before 26.2.120.1449 are vulnerable to plaintext password disclosure. The issue exists in a demo EXE/Script sensor that utilizes cscript.exe to multiply two integer parameters. If a non-numeric value is provided, cscript.exe generates a 'Type mismatch' runtime error ...

PT-2026-98283

Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The firmware contains an authentication flaw in the root account accessible via the UART Universal Asynchronous Receiver-Transmitter, a hardware communication protocol interface. This...

CVE-2026-84499

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification,...

EUVD-2026-85561

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification,...