PT-2026-64424

Name of the Vulnerable Software and Affected Versions Weintek cMT3092X affected versions not specified Description The HMI stores user account passwords in plaintext, which allows an attacker with access to the storage to retrieve sensitive credentials. Recommendations At the moment, there is no...

CVE-2026-40430

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...

Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes

A Russian state-supported espionage group spent months reading Western mailboxes through a then-unknown flaw in Zimbra's webmail client. The payload goes after the last 90 days of email, the organization's entire email directory, the password saved in the browser and the codes kept for two-factor...

CVE-2026-47755

CVE-2026-47755 : ITFlow prior to v26.05 is vulnerable to authenticated cross-tenant credential disclosure. A low-privileged authenticated agent can fetch plaintext credentials and TOTP secrets of another client by loading the credential edit modal for an arbitrary credential_id due to missing cli...

USN-8601-1 pam vulnerability

It was discovered that PAM had a timing discrepancy in the pamuserdb module when comparing plaintext passwords. An attacker could possibly use this issue to obtain sensitive information by measuring response-timing differences during repeated authentication attempts...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Passwords in Google Chrome before version 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

Incorrect Implementation of Authentication Algorithm

Overview Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each...

CVE-2026-16624

CVE-2026-16624 affects Cal.com OSS, where there is an authorization bypass on webhook creation via unvalidated teamId injection. Any authenticated user can create a webhook on any team and potentially exfiltrate booking data (e.g., organizer/attendee emails and custom responses) and, in some case...

EUVD-2026-47769

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords...

CVE-2026-16624 CVE-2026-16624

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords...

CVE-2026-16624 CVE-2026-16624

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords...

CVE-2026-13034

A flaw was found in Google Chrome's Passwords feature. A remote attacker could exploit this vulnerability by compromising the browser's rendering engine and then using a specially designed web page. This could allow the attacker to bypass security measures designed to isolate websites, potentiall...

Plone 4.0.x < 4.3.20 / 5.0.x < 5.1.7 / 5.2.x < 5.2.2 Multiple Vulnerabilities (HF 20200121)

The version of Plone installed on the remote host is 4.0.x prior to 4.3.20, 5.0.x prior to 5.1.7, or 5.2.x prior to 5.2.2. It is, therefore, affected by the following vulnerabilities: - An open redirect on the login form and possibly other places allows an attacker to craft a link to a Plone Site...

CVE-2024-5300

The CVE concerns Canonical snapd’s base AppArmor profile misconfiguration. Abstraction rules in /etc/apparmor.d/abstractions/nss-systemd allow strictly confined snaps to access io.systemd.Multiplexer and io.systemd.NameServiceSwitch sockets in /run/systemd/userdb/, bypassing sandbox restrictions....

CVE-2024-5300

An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd inherited via inadvertently permit strictly confined snap applications, which...

UBUNTU-CVE-2024-5300

An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd inherited via inadvertently permit strictly confined snap applications, which...

Examining User Behavior and Cognitive Biases in Personal Password Security

Despite increasing awareness of cybersecurity risks, users continue to engage in insecure password practices, such as reusing passwords, choosing weak credentials, and neglecting security recommendations. The study explores the behavioral and cognitive factors that influence password...

PT-2026-61714

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.4.3 Description rsync is a file-copying tool utilizing a delta-transfer algorithm to synchronize files. The receiver's compressed-token decoder fails to check for overflow when accumulating a 32-bit signed counter. A...

OESA-2026-3008 pam security update

PAM Pluggable Authentication Modules is a system of libraries that handle the authentication tasks of applications services on the system. Security Fixes: Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...