iCULeak.py

iCULeak.py Tool to find and extract credentials from phone configuration files in environments managed by Cisco's CUCM Call Manager. When using Cisco's CUCM Call Manager, phone configuration files are stored on a TFTP server. These VoIP phone configuration files quite frequently contain sensitive...

CVE-2026-121021

Plaintext Storage of a Password CWE-256 in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration backups to obtain the password of the LDAP directory service...

CVE-2026-121021 Plaintext Storage of LDAP Password in Axxon One Shared Configuration

Plaintext Storage of a Password CWE-256 in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration backups to obtain the password of the LDAP directory service...

EUVD-2026-115714

Plaintext Storage of a Password CWE-256 in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration backups to obtain the password of the LDAP directory service...

CVE-2026-121021

AxxonSoft Axxon One versions before 3.1.0 on Windows and Linux are susceptible to a plaintext storage of a password (CWE-256) vulnerability. The root cause is the insecure storage of the LDAP directory service account password within the main.conf configuration file of the SecurityManager shared ...

CVE-2025-70962

CVE-2025-70962 Use of Hard-coded Credentials in ZOSI C519M IP camera RTSP service Field| Value ---|--- CVE ID| CVE-2025-70962 Vendor| ZOSI Technology Product| ZOSI C519M smart IP camera also listed as model 1NC-519M Affected versions| Firmware V4.2.8.832C01450BA tested build; earlier versions not...

Digisol-DG-GR1321-s-Password-Storage-in-Plaintext-CVE-2024-4232

Digisol-DG-GR1321-s-Password-Storage-in-Plaintext-CVE-2024-4232...

CVE-2026-114217

A flaw was found in konflux-ci. Continuous Integration CI automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized reposito...

CVE-2026-86715

Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials. This issue affects Vatos DLP: from 1.1.176 before 1.1.243...

EUVD-2026-113945

Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials. This issue affects Vatos DLP: from 1.1.176 before 1.1.243...

CVE-2026-86715: Kriptek Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP: Plaintext storage of a password vulnerability in Kriptek Crypto and Informatics Technologies Industry and Trade Inc

Plaintext storage of a password vulnerability in Kriptek Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials. This issue affects Vatos DLP: from 1.1.176 before 1.1.243...

PT-2026-133563

Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials. This issue affects Vatos DLP: from 1.1.176 before 1.1.243...

IBM Langflow OSS encryption issue vulnerability

Versions 1.0.0 through 1.12.4 of IBM Langflow OSS contain an encryption vulnerability. This vulnerability arises because sensitive information is stored in plaintext, potentially allowing remote authenticated attackers to obtain such information...

MailEnable Auth Cleartext Storage Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of mailbox credentials. The issue results from storing sensitive...

CVE-2026-116198 Snipe-IT before 8.7.0 Missing Encryption via Api AssetsController store

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encryptedcustomfields. Authenticated API users without that permission can create assets whose sensitive...

EUVD-2026-109456

Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encryptedcustomfields. Authenticated API users without that permission can create assets whose sensitive...

Improper output handling vulnerability in MongoDB C# Driver

A vulnerability related to improper output handling exists in MongoDB C Driver versions from 2.10.0 up to but including 3.13.0. This vulnerability arises because client-side encryption support fails to perform internal name conversion under certain platform text encoding configurations. As a...

GO-2026-6748 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

PT-2026-118053

Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

SUSE CVE-2026-109970

A flaw was found in the clevis PKCS11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the...