GO-2026-6748 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

CVE-2025-70962

CVE-2025-70962 Use of Hard-coded Credentials in ZOSI C519M IP camera RTSP service Field| Value ---|--- CVE ID| CVE-2025-70962 Vendor| ZOSI Technology Product| ZOSI C519M smart IP camera also listed as model 1NC-519M Affected versions| Firmware V4.2.8.832C01450BA tested build; earlier versions not...

Digisol-DG-GR1321-s-Password-Storage-in-Plaintext-CVE-2024-4232

Digisol-DG-GR1321-s-Password-Storage-in-Plaintext-CVE-2024-4232...

iCULeak.py

iCULeak.py Tool to find and extract credentials from phone configuration files in environments managed by Cisco's CUCM Call Manager. When using Cisco's CUCM Call Manager, phone configuration files are stored on a TFTP server. These VoIP phone configuration files quite frequently contain sensitive...

CVE-2026-63315 Plaintext storage of a password in WebCTI

WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account. This issue was fixed in IPx series version 6.62.0100...

CVE-2026-63315

The WebCTI service for Slican IPx telephone exchanges is vulnerable to plaintext storage of temporary subscriber passwords. An attacker who gains access to the database can retrieve these passwords to log into subscriber accounts. This issue is resolved in IPx series version 6.62.0100 . No specif...

CVE-2026-109970

A flaw was found in the clevis PKCS11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the...

CVE-2026-102539

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls synctrue before a user sets an encryption password, causing the operation-upload path to transmit and store all use...

CVE-2026-102539 Super Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is set

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls synctrue before a user sets an encryption password, causing the operation-upload path to transmit and store all use...

CVE-2026-102539 Super Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is set

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls synctrue before a user sets an encryption password, causing the operation-upload path to transmit and store all use...

CVE-2026-102539

The Super Productivity todo list app (versions 17.3.0 through 18.13.1 ) contains a vulnerability where the SuperSync end-to-end encryption setup transmits and stores user operations in plaintext before an encryption password is set. This occurs because the system calls sync(true) prematurely, pot...

PT-2026-110961

Name of the Vulnerable Software and Affected Versions Super Productivity versions 17.3.0 through 18.13.0 Description The SuperSync end-to-end encryption E2EE setup calls the synctrue function before a user defines an encryption password. This causes the operation-upload path to transmit and store...

CVE-2026-62376

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or...

CVE-2026-62376 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or...

CVE-2026-62376

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the "usertokens" table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or...

EUVD-2026-95994

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or...

CVE-2026-62376 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or...

CVE-2026-62376 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or...

CVE-2026-62376

The open-source task management platform Vikunja (versions prior to 2.4.0 ) is vulnerable to account takeover due to the plaintext storage of sensitive tokens in the user_tokens table. Specifically, password-reset , email-confirmation , and account-deletion tokens are stored as raw random strings...

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

Summary Vikunja stores password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or SQL-level exposure, they can immediately use pending tokens to take over...