CVE-2026-55860 MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a...

PT-2026-83365

Name of the Vulnerable Software and Affected Versions IGEL OS 12 versions prior to 12.7.6 IGEL OS 11 versions prior to 11.11.150 Description An issue exists where attackers with physical access can execute arbitrary Linux loader parameters. This is possible by writing to an unencrypted and unsign...

PT-2026-83376

Name of the Vulnerable Software and Affected Versions MariaDB Connector/R2DBC versions prior to 1.4.1 Description The driver does not require a secure transport before using clear-text password authentication plugins. A hostile or man-in-the-middle MariaDB server can send an AuthSwitchRequest...

PYSEC-2026-3797

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-81703

openssl_encrypt versions before 1.4.9 fail to validate the encryption status of embedded post-quantum private keys in file metadata. An attacker can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext wit...

CVE-2026-81703 openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

CVE-2026-81703 openssl_encrypt before 1.4.9 Authentication Bypass via Unencrypted PQC Key

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

CVE-2026-79782

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers...

JetBrains TeamCity < 2018.2.3 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2018.2.3. It is, therefore, affected by multiple vulnerabilities: - A possible stored JavaScript injection was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.3. CVE-2019-12844 - The...

The vulnerability of the current_value_store() function in the drivers/platform/x86/think-lmi.c module of the Linux operating system’s X86 device support driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the currentvaluestore function in the drivers/platform/x86/think-lmi.c module of the Linux kernel’s X86 device support driver lies in the fact that authentication data is stored in configuration files in an unencrypted form. Exploiting this vulnerability could allow an attack...

The vulnerability of the set_new_password() function in the drivers/platform/x86/dell/dell-wmi-sysman/passwordattr-interface.c driver for X86 Linux operating system, which allows a hacker to trigger a service failure.

The vulnerability of the setnewpassword function in the drivers/platform/x86/dell/dell-wmi-sysman/passwordattr-interface.c file of the Linux operating system’s X86 device driver module is related to the unencrypted storage of critical information. Exploiting this vulnerability could allow an...

The vulnerability of the cifs_set_cifscreds() function in the fs/smb/client/connect.c module of the Smb file system in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the cifssetcifscreds function in the fs/smb/client/connect.c module of the Smb file system in Linux kernel is related to the unencrypted storage of critical information. Exploiting this vulnerability could allow an attacker to cause service failures...

CVE-2026-77812

DJI drones transmit DUML DJI Universal Markup Language protocol messages over BLE Bluetooth Low Energy without encryption. When a client attempts to connect to the drone over Wi-Fi, or when the drone is switched to QuickTransfer mode, the DJI Fly application exchanges DUML messages with the drone...

PT-2026-79388

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...

CVE-2026-19683 Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways

A vulnerability exists in the Dynamic DNS DDNS functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and th...

EUVD-2026-63545

A vulnerability exists in the Dynamic DNS DDNS functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and th...

CVE-2026-19683 Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways

A vulnerability exists in the Dynamic DNS DDNS functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and th...

PT-2026-79104

A vulnerability exists in the Dynamic DNS DDNS functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and th...