CVE-2026-31278

Suprema BioStar 2 (before 2.9.12 ) and BioStar X (before 1.0.2 ) expose Active Directory service account credentials in cleartext via a crafted GET request to the /api/v2/setting/adserversetting endpoint. The vulnerability requires low privileges and has a changed scope , as the leaked credential...

EUVD-2026-77158

An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request...