2209 matches found
CVE-2025-12772 Plaintext Switch admin login password is seen in Brocade SANnav support save
Brocade SANnav before 2.4.0b logs the Brocade Fabric OS Switch admin password on the SANnav support save logs. When OOM occurs on a Brocade SANnav server, the call stack trace for the Brocade switch is also collected in the heap dump file which contains this switch password in clear text. The...
Exploit for CVE-2026-25211
Llama Stack pgvector Password Leak PoC CVE-2026-25211 Loc...
CVE-2026-25211
Llama Stack aka llama-stack before 0.4.0rc3 does not censor the pgvector password in the initialization log...
CVE-2026-25211
Llama Stack aka llama-stack before 0.4.0rc3 does not censor the pgvector password in the initialization log...
PT-2026-5384
Name of the Vulnerable Software and Affected Versions Llama Stack versions prior to 0.4.0rc3 Description The software does not properly conceal the pgvector password within the initialization logs, potentially exposing sensitive credentials. Recommendations Update to version 0.4.0rc3 or later...
Llama Stack log information leakage vulnerability
Llama Stack is a core building block for simplified artificial intelligence application development, open-sourced by Meta Llama. Versions of Llama Stack prior to 0.4.0rc3 contained a vulnerability related to log information leakage. This vulnerability stemmed from the fact that the log...
CVE-2025-57796
Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the encrypted data are obtained...
CVE-2025-12386
Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoint to e.g: retrieve cleartext password to the access point. The vendor was notified early about this vulnerability, but didn't respond with...
CVE-2025-12386 Missing Authentication for Critical Endpoint in Pix-Link LV-WR21Q
Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoint to e.g: retrieve cleartext password to the access point. The vendor was notified early about this vulnerability, but didn't respond with...
CLSA-2026-1769507907 Fix CVE(s): CVE-2024-50349
SECURITY UPDATE: Confusing users into sending their passwords to sites under the attacker’s control using crafted URLs - debian/patches/CVE-2024-50349.patch: also encode : in credentialformat, sanitize the user prompt - CVE-2024-50349...
Plaintext Switch admin login password is seen in Brocade SANnav support save (CVE-2025-12772)
Brocade SANnav before 2.4.0b logs the Brocade Fabric OS Switch admin password on the SANnav support save logs. When OOM occurs on a Brocade SANnav server, the call stack trace for the Brocade switch is also collected in the heap dump file which contains this switch password in clear text. The...
Password Exposure in Brocade Fabric OS before 9.2.1 (CVE-2025-58379)
Brocade Fabric OS before 9.2.1 has a vulnerability that could allow a local authenticated attacker to reveal command line passwords using commands that may expose higher privilege sensitive information by a lower privileged user...
CVE-2025-59093 Insecure Password Derivation Function for Database Administrator in dormakaba Kaba exos 9300
Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concatenated to the hostname and a random string that can be read by every user from the registry. This allows an attacker t...
Tenda W30E security vulnerabilities
The Tenda W30E is a router produced by the Chinese company Tenda. Versions of the Tenda W30E such as V2 and V16.01.0.195037 have security vulnerabilities. These vulnerabilities stem from the use of predefined default passwords, which may allow attackers to gain access to the management interface...
CVE-2026-23846
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially...
MiracleLinux 8 : fwupd-1.7.8-2.el8.ML.1 (AXSA:2023-7312:04)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-7312:04 advisory. fwupd: world readable password in /etc/fwupd/redfish.conf CVE-2022-3287 Tenable has extracted the preceding description block directly from the MiracleLinux...
MiracleLinux 9 : fwupd-1.8.10-2.el9.ML.1 (AXSA:2023-5696:02)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5696:02 advisory. fwupd: world readable password in /etc/fwupd/redfish.conf CVE-2022-3287 shim: 3rd party shim allow secure boot bypass CVE-2022-34301 shim: 3rd party...
MiracleLinux 9 : libreoffice-7.1.8.1-8.el9.ML.1 (AXSA:2023-5035:03)
The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5035:03 advisory. libreoffice: Macro URL arbitrary script execution CVE-2022-3140 libreoffice: Execution of Untrusted Macros Due to Improper Certificate Validation...
CVE-2026-23846
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially...
EUVD-2026-3294
Tugtainer is a self-hosted app for automating updates of Docker containers. In versions prior to 1.16.1, the password authentication mechanism transmits passwords via URL query parameters instead of the HTTP request body. This causes passwords to be logged in server access logs and potentially...