EUVD-2026-66229

A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions allows an unauthenticated attacker with physical proximity to retrieve LoRaWAN ABP NwkSKey and AppSKey values and D2D keys via an NFC rea...

EUVD-2026-66228

duplicate record...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104784)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104784 advisory. Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version an...

PT-2026-82340

Name of the Vulnerable Software and Affected Versions community.general Ansible collection affected versions not specified Description A flaw exists in the ipa getkeytab module where the bind pw parameter, used for LDAP simple-bind passwords during Kerberos keytab retrieval, lacks the no log...

CVE-2026-77131

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

EUVD-2026-65344

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

CVE-2026-77131 Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key...

CVE-2026-77131

CVE-2026-77131 affects the TYPO3 extension SYSSY – TYPO3 Monitoring & Security Checks (syssy). When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it, resulting in a cleartext transmission of sensitive data. Exploitation r...

TYPO3-EXT-SA-2026-015: Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-015...

MAL-2026-14476 Malicious code in ecobee2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba package.json declares scripts.postinstall = 'node beacon.js', which runs automatically on npm install. beacon.js performs an HTTP GET to...

Malicious code in ecobee2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba package.json declares scripts.postinstall = 'node beacon.js', which runs automatically on npm install. beacon.js performs an HTTP GET to...

Vulnerability Resolved in Veeam Backup & Replication 13.1

Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we operate a Vulnerability Disclosure Program VDP for all Veeam products and perform extensive internal code audits. When a vulnerability is...

Astra Linux – Vulnerability in Lynx

Lynx versions up to 2.8.9 mishandled the userinfo subcomponent of a URI, allowing remote attackers to discover cleartext credentials, as these credentials might appear in SNI data...

Astra Linux – Vulnerability in curl

A user can specify that curl = 7.20.0 and = 7.78.0 requires a successful upgrade to TLS when communicating with IMAP, POP3, or FTP servers. This is achieved by using the --ssl-reqd option on the command line, or setting CURLOPT USESSL to CURLUSESSLCONTROL or CURLUSESSLALL with licurl. This...

BIT-PYTHON-MIN-2026-15806 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching

The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also us...

Malicious code in sm-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa2741ebbd0df8c6f349a4d34361cc3d814fe878f3f4521fd771a855cfdc152b Package [email protected] defines preinstall and postinstall lifecycle scripts that issue plain-HTTP GET requests to a hardcoded bare-IP endpoint at...

CVE-2026-27875

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...

CVE-2026-27875 Simplex Incident Manager Clear Test

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...

CVE-2026-27875

Johnson Controls Simplex Incident Manager / Autocall Fire Administrator (before 2.01.05 ) stores user credentials—passwords and authentication tokens—in unencrypted form within system memory while running. A local attacker with low privileges can extract these embedded sensitive data using memory...

EUVD-2026-64036

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...