188 matches found
agent-vault-proxy
Keys on the Wire Your AI agent never holds your API keys. It sends a placeholder; the real secret is swapped in on the wire. Stops credential stealers Shai-Hulud and similar and prompt-injected agents from leaking your secrets. A compromised agent has nothing to take. How it works 1. Your agent...
n8n authorization issue vulnerability
Versions prior to n8n 1.123.85, 2.43.5, and 2.44.1 contain an authorization issue vulnerability stemming from a bypass of credential protection. This allows shared workflow editors to use restricted credentials by loading sub-workflows via URLs or local files. Attackers can configure the source u...
Google Agent Mesh authorization issue vulnerability
A security vulnerability exists in Google Agent Mesh versions from 0.1.0-alpha.1 through 0.1.0-alpha.8. This vulnerability stems from the lack of proper authentication and insufficient credential protection in the control plane registration status handler GET /enroll/status. Unauthenticated remot...
CVE-2026-109953
FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode...
Rocket Software Rocket Remote Desktop security vulnerability
The Rocket Software Rocket Remote Desktop version 18.0.8583.1 contains a security vulnerability stemming from insufficient credential protection, which may lead to credential leakage...
CVE-2026-89064
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...
EUVD-2026-81315
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...
CVE-2026-89064
All-in-One WP Migration and Backup for WordPress (≤ 7.110 ) contains an unauthenticated Insufficient Credential Protection flaw discovered by Jakub Herman. The Ai1wm_Main_Controller::init() method, registered on the admin_init hook, reads $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] from...
CVE-2026-89064: Insufficiently Protected Credentials
The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and including, 7.110. This is due to the Ai1wmMainController::init method — registered on the admininit hook, which fires unauthenticated on admin-ajax.php and...
WordPress All-in-One WP Migration and Backup plugin <= 7.110 - Unauthenticated Insufficient Credential Protection vulnerability
Unauthenticated Insufficient Credential Protection vulnerability discovered by Jakub Herman in WordPress Plugin All-in-One WP Migration versions = 7.110...
EUVD-2026-77239
Insufficiently protected credentials issue exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. If this vulnerability is exploited, sensitive information may be restored from a backup file...
PT-2026-91090
Insufficiently protected credentials issue exists in Remote I/O Coupler Unit Server Type CPSN-MCB271-. If this vulnerability is exploited, sensitive information may be restored from a backup file...
CVE-2026-78627
Okta Hyperdrive Integration installer exposes the OAuth client secret in plaintext when it is passed as an MSI property. The credential is recorded in three locations readable by an authenticated local user: the installer log , the Application Event Log , and the process command line . The CVSS 3...
CVE-2026-78627 Improper Credential Protection in Okta Hyperdrive Integration Installer Logging
The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the...
CVE-2026-77909
Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network...
CVE-2026-64918
Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network...
EUVD-2026-73643
Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-64918
CVE-2026-64918 is a spoofing vulnerability in Microsoft Office caused by insufficiently protected credentials , allowing an unauthorized attacker to perform spoofing over a network. The attack requires user interaction but needs no prior privileges and has low complexity , with a high impact on c...