CVE-2024-28085

Wall-Escape CVE-2024-28085 The util-linux wall command does not filter escape sequences from command line arguments. The vulnerable code was introduced in commit cdd3cc7fa4 2013. Every version since has been vulnerable. A full report can be found here. I have nicknamed this bug "WallEscape". This...

CVE-2026-107819

The MariaDB Connector/C library, specifically the libmariadb component, is vulnerable in versions 3.4.1 through 3.4.10 . The Zero-Configuration SSL authentication-switch logic fails to reject TLS hostname verification mismatches before selecting a non-hashing authentication plugin. This flaw allo...

CVE-2026-107819 MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure

MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname...

CVE-2026-107819 MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure

MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname...

CVE-2026-107819 MariaDB Connector/C: libmariadb allowed cleartext password leakage on TLS hostname verification failure

MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname...

Digital-Privacy

English | 简体中文 There are two kinds of cryptography in this world: cryptography that will stop your kid sister from reading your files, and cryptography that will stop major governments from reading your files. Bruce Schneier《Applied Cryptography》 Content : Information Protection, Open-source...

Astra Linux – Vulnerability in curl

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname, but the...

Astra Linux – Vulnerability in Ruby 2.5

URI is a module that provides classes for handling Uniform Resource Identifiers. In versions 0.12.4 and earlier bundled with Ruby 3.2 series, 0.13.2 and earlier bundled with Ruby 3.3 series, 1.0.3 and earlier bundled with Ruby 3.4 series, when using the + operator to combine URIs, sensitive...

Astra Linux – Vulnerability in Chromium

The inappropriate implementation of passwords in Google Chrome prior to version 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible’s amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to exploit the issue, as the module handles the parameter insecurely, resulting in the password being leaked in the logs...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible 2.7.16 and earlier versions, as well as 2.8.8 and earlier, and 2.9.5 and earlier. When a password is set using the “password” argument of the svn module, it is used in the svn command line, thereby exposing it to other users within the same node. An attacker could...

CVE-2026-76839

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

CVE-2026-8810

On ARM platforms, an architecture-design flaw in HDD Password handling allows an attacker to retrieve the password from UEFI variables. CVSS 6.9 MEDIUM; physical access, high complexity, low privileges required. Exploitation details not provided in the documents.

JLSEC-2026-1208 When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl...

When asked to both use a .netrc file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances...

CVE-2026-54203

Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds with memory. By repeatedly requesting this endpoint, an attacker can access sensitive...

PT-2026-68110

Name of the Vulnerable Software and Affected Versions Paperless-ngx affected versions not specified Description An issue exists in the MailAccountViewSet.test action. When this action is called using an existing account ID and a masked password field, the system reuses the stored password, accoun...

PT-2026-66034

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description An inappropriate implementation in the Passwords component allows a remote attacker to leak cross-origin data. This occurs when a user is convinced to perform specific UI gestures while...

CVE-2024-23564

HCL Aftermarket EPC is affected by Business Logic Vulnerability using which a non valid user of the application can obtain passwords from the server and redirect them to their own email address by manipulating the server's response. The application includes checks in the initial requests to verif...

CVE-2026-22096

CVE-2026-22096 concerns a webserver running on port 8090 that does not require authentication, enabling sensitive information leakage (e.g., configured passwords) and file uploads via multiple endpoints. The Connected documents provide the same description across NVD and CVE records, with no vend...

CVE-2026-22096 Missing authentication for webserver endpoints

The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints...