PT-2026-94117

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description When a Django Model instance is assigned to a public view attribute, the software serializes it to the client without a sensitive-field denylist. This results in the exposure of sensitive data to the...

PT-2026-94071

Name of the Vulnerable Software and Affected Versions OpenSign versions prior to 2.41.4 Description The getDocument cloud function fails to validate the identity of the caller when one-time-password verification is disabled. An attacker can provide a document identifier obtained from guest signin...

CVE-2026-92467: Unverified Password Change

zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current password check. Attackers can supply an arbitrary user id in the request bod...

CVE-2026-90969

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...

CVE-2026-19641

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...

CVE-2026-90969

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...

CVE-2026-90969

An improper access control vulnerability exists in the vault entry listing feature of Devolutions Server 2026.2.16 and earlier versions. This flaw allows an authenticated user who lacks the specific view-password permission to obtain cleartext passwords . The vulnerability is triggered by sending...

EUVD-2026-79185

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters...

CVE-2026-73466

CVE-2026-73466 affects Arista EOS , where plaintext user passwords may be written to log files (/var/log/agents/Aaa-*) under CWE-532 (Insertion of Sensitive Information into Log File). The precondition is that PyServer trace level 4 on agent Aaa is explicitly enabled via a non-standard debugging ...

CVE-2026-19641 On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...

EUVD-2026-79141

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...

CVE-2026-19641

CVE-2026-19641 affects Arista EOS devices where password-based login authentication is enabled (e.g., SSH password or Telnet). Due to CWE-116 (Improper Encoding or Escaping) , a specially crafted password can create orphan authentication sessions that accumulate in a limited session pool, eventua...

CVE-2026-19641 On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the...

CVE-2026-11921

IBM Verify Identity Access containers may not apply management password change operations correctly...

EUVD-2026-78897

IBM Verify Identity Access containers may not apply management password change operations correctly...

CVE-2026-11921 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access containers may not apply management password change operations correctly...

CVE-2026-11921

IBM Verify Identity Access containers may not correctly apply management password change operations, leading to insufficiently protected credentials (CWE-522). This issue affects IBM Verify Identity Access (v11.0.0 - 11.0.3 IF1), IBM Security Verify Access (v10.0.0 - 10.0.9.2 IF1), and their resp...

CVE-2026-11921 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access containers may not apply management password change operations correctly...

CVE-2026-46488 motionEye: Authentication possible via password hash

motionEye mEye is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meyeusername and meyepasswordhash cookies as authentication material without server-side session...

CVE-2026-91972

Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token routes. Remote unauthenticated attackers can perform unbounded credential guessing, account enumeration, and password-reset flooding...