CVE-2026-75847

ash_paper_trail (by ash-project) is an Elixir audit/versioning library. The changes map in the generated version resource is declared public? true and sensitive? false because AshPaperTrail.Resource.Transformers.CreateVersionResource derives sensitivity from ignore_attributes (which defaults to e...

CVE-2026-82453

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

CVE-2026-82453 rust-iot-platform Cleartext Password Storage via User Model

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

EUVD-2026-68108

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts...

CVE-2026-82453

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts. The vulnerability is scored CVSS 3.1: 7.5 (HIGH) and CVSS 4.0: ...

CVE-2026-55860

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a...

CVE-2026-55857

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behin...

CVE-2026-55854

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In...

org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

Summary The connector does not gate clear-text password authentication plugins on transport encryption. A hostile or man-in-the-middle MariaDB server can request a clear-text plugin over an unencrypted plain-TCP connection, and the driver responds with the user's password in cleartext on the wire...

GHSA-C857-9X2M-CVH2 org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

Summary The connector does not gate clear-text password authentication plugins on transport encryption. A hostile or man-in-the-middle MariaDB server can request a clear-text plugin over an unencrypted plain-TCP connection, and the driver responds with the user's password in cleartext on the wire...

CVE-2026-55860

MariaDB Connector/R2DBC (org.mariadb:r2dbc-mariadb), a non-blocking Java R2DBC client for MariaDB/MySQL, is affected by a cleartext password disclosure vulnerability prior to version 1.4.1. The AuthenticationPlugin interface lacks the ability to require a secure connection, so clear-text password...

CVE-2026-55860 MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a...

CVE-2026-55860 MariaDB Connector/R2DBC: Cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authentication plugins on transport encryption because the AuthenticationPlugin interface has no capability for a plugin to require a...

org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

Summary When PAM dialog authentication is used, the connector can be coerced into sending the account password in cleartext over an insecure connection. A hostile or man-in-the-middle server can trigger this with the default configuration, disclosing the user's password. Details The...

GHSA-QXVW-FVWX-5CP7 org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

Summary When PAM dialog authentication is used, the connector can be coerced into sending the account password in cleartext over an insecure connection. A hostile or man-in-the-middle server can trigger this with the default configuration, disclosing the user's password. Details The...

EUVD-2026-68020

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behin...

CVE-2026-55857 MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behin...

CVE-2026-55857 MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behin...

CVE-2026-55857

MariaDB Connector/J (versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9) is vulnerable to cleartext password transmission during PAM dialog authentication . The PAM handler SendPamAuthPacketFactory (referred to as dialog by the server) does not declare a secure-transport requirement and inherits t...

CVE-2026-55857 MariaDB Connector/J: Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be coerced into transmitting the account password over an insecure connection. The mysqlclearpassword plugin is gated behin...