PT-2026-82610

Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9 Description The sanitize argv for debug function fails to sanitize the keyserver bearer token when passed as a positional argument to the 'keyserver set-token' command. Consequently, when the --debug fla...

PT-2026-82777

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions...

CVE-2026-80158

A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with nolog, unlike the sibling password parameter in the same module. As a...

DEBIAN-CVE-2026-80158

A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with nolog, unlike the sibling password parameter in the same module. As a...

CVE-2026-58070

A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials...

CVE-2026-80158

A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with nolog, unlike the sibling password parameter in the same module. As a...

CVE-2026-58070

A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials...

CVE-2026-58070

CVE-2026-58070 affects Veeam Backup & Replication 13.0.2.29 and all earlier 13.x builds (Windows-based and Veeam Software Appliance deployments; older 12.x versions are not affected). The root cause is that guest OS credentials used for Application Aware processing are written in cleartext to a s...

CVE-2026-48786

Fleet , an open-source device management platform built on osquery, has an information disclosure flaw in the target search endpoint (POST /api/latest/fleet/targets). Prior to v4.87.0 , this endpoint failed to mask team enroll secrets and full team configuration (including credential-bearing agen...

EUVD-2026-66423

Rently Smart Home versions 20.1.0 and prior are vulnerable to an Insufficiently Protected Credentials vulnerability. This could allow an attacker to retrieve pins including the Master Pin, overriding standard user permissions...

Linux Distros Unpatched Vulnerability : CVE-2026-79776

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can...

PT-2026-82366

Name of the Vulnerable Software and Affected Versions DXPR Builder: The Best Editing AI Experience for Drupal versions 0.0.0 through 2.8.1 Description DXPR Builder allows Forceful Browsing due to the insertion of sensitive information into sent data. In the 2.x version, the module does not...

PT-2026-82340

Name of the Vulnerable Software and Affected Versions community.general Ansible collection affected versions not specified Description A flaw exists in the ipa getkeytab module where the bind pw parameter, used for LDAP simple-bind passwords during Kerberos keytab retrieval, lacks the no log...

CVE-2026-62865

Typebot (open-source chatbot builder), in self-hosted versions prior to 3.18.0 , allows arbitrary local file read through the server-side Send Email integration block. The parseAttachments helper treats any attachment value not matching the application's base URL as a filesystem path, and the Nod...

CVE-2026-65087

NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials . A successful exploit of this vulnerability might lead to information disclosure and data tampering...

CVE-2026-79776

rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials...

CVE-2026-79780 rclone before v1.75.0 Credential Exposure via S3 Redirect

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

CVE-2026-79780 rclone before v1.75.0 Credential Exposure via S3 Redirect

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

CVE-2026-79780

rclone before v1.75.0 contains a credential exposure vulnerability in its S3 redirect callback handling. The tool fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys when following redirects, allowing credentials to persist across scheme or host changes . An attacker positioned to o...

CVE-2026-79779 rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirect

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to...