CVE-2026-71307 Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API

Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required adminpermission. DestinationOutputSchema returned raw options and copied them into pluginOptions without redacting...

CVE-2026-71307

In Lemur before 1.9.3, GET /api/1/destinations endpoints required only basic authentication, allowing low-privilege users to read plaintext SFTP passwords and private-key passphrases stored by the sftp-destination plugin. CVSS 7.7 HIGH (network, low complexity). Fixed in 1.9.3 by requiring admin ...

EUVD-2024-33422

Malicious code in bioql PyPI...

CVE-2024-10403

Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmware download operation initiated by SANnav or through WebEM in a weblinker core dump that is later captured via supportsave...

CVE-2024-10403 SFTP/FTP password could be captured in plain text in Supportsave generated from SANnav

Brocade Fabric OS versions before 8.2.3e2, versions 9.0.0 through 9.2.0c, and 9.2.1 through 9.2.1a can capture the SFTP/FTP server password used for a firmware download operation initiated by SANnav or through WebEM in a weblinker core dump that is later captured via supportsave...