CVE-2026-59271 Admin password disclosed in BrokerNotAliveException message

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

EUVD-2026-66808

A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with nolog, unlike the sibling password parameter in the same module. As a...

PT-2026-82563

Name of the Vulnerable Software and Affected Versions FrontAccounting versions prior to 2.4.21 Description User passwords are stored and verified as unsalted MD5 digests. The application fails to use per-password salts or adaptive hashing functions, meaning identical passwords result in identical...

PT-2026-82585

In openssl encrypt pip package openssl-encrypt versions /cmdline for the lifetime of the subprocess. Fixed in 1.4.9...

CVE-2026-81704: Use of Password Hash With Insufficient Computational Effort

opensslencrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faste...

PT-2026-82606

Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9 Description The software fails to redact file passwords in the --debug argv dump when passwords are provided using bundled short-option spellings e.g., -apHunter2 or abbreviated long-option spellings e.g...

CVE-2026-81818: Improper Privilege Management

Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within the...

CVE-2026-75573: Insertion of Sensitive Information into Log File

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclos...

PT-2026-82628

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description Authenticated sessions are not revoked when a user changes their password. This allows an attacker with a valid session token to maintain access to the account until the session expires naturally,...

PT-2026-82590

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software derives the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password. This results in identical keys being used across all users and files. An attacker...

CVE-2026-59271: Generation of Error Message Containing Sensitive Information

When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. Spring AMQP 4.1.0 Spring AMQP 4.0.0 - 4.0.4 Spring AMQP 3.2.0 - 3.2.12 Spring AMQP 2.4.18 and earlier...

CVE-2026-19715: Exposure of Sensitive Information to an Unauthorized Actor

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-81705: Insertion of Sensitive Information into Log File

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings e.g. -apHunter2 or abbreviated long-option spellings e.g. --passw. The sanitizer only recognized exact option names, --option=value forms, and...

CVE-2026-81826: Insufficient Session Expiration

Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attacker already possesses a valid session—for example, from prior access or a stolen session token—the victim changing their password does not terminate that...

PT-2026-82392

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

PT-2026-82625

Name of the Vulnerable Software and Affected Versions Flowintel versions 3.3.0 and later Description An authorization flaw exists in the administrative user-edit API. While the system prevents organization administrators from editing users in different organizations, it fails to restrict them fro...

CVE-2026-80211: Use of Password Hash With Insufficient Computational Effort

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5$POST'password' to adduser and updateuserpassword, admin/changecurrentuserpassword.php does the same when a user changes their own password, the forgotten-password path in...

CVE-2026-81684: Invocation of Process Using Visible Sensitive Information

In opensslencrypt pip package openssl-encrypt versions = 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument on both encrypt and decrypt paths instead of via an environment variable as done for the main password...

PT-2026-82414

Name of the Vulnerable Software and Affected Versions Spring AMQP version 4.1.0 Spring AMQP versions 4.0.0 through 4.0.4 Spring AMQP versions 3.2.0 through 3.2.12 Spring AMQP versions 2.4.18 and earlier Description When the RabbitMQ management aliveness check fails, the configured admin password ...

Linux Distros Unpatched Vulnerability : CVE-2026-80158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind...