CVE-2026-50641

Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...

CVE-2026-50641 Plaintext password storage in Streamsoft Business Intelligence

Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...

CVE-2026-50641 Plaintext password storage in Streamsoft Business Intelligence

Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...

CVE-2026-50641

Streamsoft Business Intelligence (BI) stores users’ passwords in plaintext in the database. The issue is mitigated in version 6.8.0.0, and users were also prompted to change their password on first login. Impact is Confidentiality (high) with no reported impact to integrity or availability. The a...

EUVD-2026-50306

Streamsoft Business Intelligence BI stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login...

CVE-2026-61886

Weintek cMT3092X HMI stores user account passwords in plaintext...

CVE-2026-61886

Weintek cMT3092X HMI is affected by CVE-2026-61886 due to plaintext storage of user account passwords. The vulnerability resides in how credentials are stored, enabling potential exposure of confidential data. Affected component: Weintek cMT3092X HMI (password storage mechanism). Root cause: plai...

PT-2026-64424

Name of the Vulnerable Software and Affected Versions Weintek cMT3092X affected versions not specified Description The HMI stores user account passwords in plaintext, which allows an attacker with access to the storage to retrieve sensitive credentials. Recommendations At the moment, there is no...

OESA-2026-3008 pam security update

PAM Pluggable Authentication Modules is a system of libraries that handle the authentication tasks of applications services on the system. Security Fixes: Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

CVE-2026-63307

CVE-2026-63307 affects Chat2DB prior to 5.3.0. The vulnerability is an insecure direct object reference in GET /api/connection/datasource/{id}. The handler calls dataSourceService.queryExistent(id, …) without an ownership check and returns the decrypted password field, enabling any authenticated ...

CVE-2026-46514 Frogman: Plaintext passwords and secrets persisted to audit log

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fmresetpassword in Tools/ResetPassword.php:48-53 returned a plaintext password and fmaddextension in Tools/AddExtension.php:172 returned a plaintext secret; Frogman.class.php:2207-2211 used auditOutcome to JSON-encode...

PYSEC-2026-2587 Lemur user-update path stores plaintext passwords

Summary lemur.users.service.update writes a user's new password as plaintext to the users.password column. The User model wires bcrypt hashing to SQLAlchemy's beforeinsert event but registers no equivalent listener for beforeupdate, and service.update does not call user.hashpassword after assigni...

OESA-2026-2902 pam security update

PAM Pluggable Authentication Modules is a system of libraries that handle the authentication tasks of applications services on the system. Security Fixes: Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

OESA-2026-2900 pam security update

PAM Pluggable Authentication Modules is a system of libraries that handle the authentication tasks of applications services on the system. Security Fixes: Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in...

Ansible Community General Collection is vulnerable to exposure of sensitive information

A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure IE of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and...

PYSEC-2026-1119 Ansible Community General Collection is vulnerable to exposure of sensitive information

A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure IE of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and...

CVE-2026-58167

Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...

CVE-2026-58167 Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users

Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...

EUVD-2026-40374

Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...

CVE-2026-58167 Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users

Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...