2536 matches found
EUVD-2026-56235
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the handleGetSheets API handler POST /api/sheets/getSheets does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data...
CVE-2026-47702
TypeBot is a chatbot builder tool. In version 3.16.1, API tokens bearer credentials used to authenticate against the builder API are stored in the database as cleartext strings. An attacker who gains read access to the database e.g., via SQL injection, backup exposure, or insider access can extra...
EUVD-2026-56152
TypeBot is a chatbot builder tool. In version 3.16.1, API tokens bearer credentials used to authenticate against the builder API are stored in the database as cleartext strings. An attacker who gains read access to the database e.g., via SQL injection, backup exposure, or insider access can extra...
CVE-2026-47702
Technical details are not publicly available in the provided documents. Monitor for updates.
CVE-2026-47702 TypeBot API tokens stored in plaintext
TypeBot is a chatbot builder tool. In version 3.16.1, API tokens bearer credentials used to authenticate against the builder API are stored in the database as cleartext strings. An attacker who gains read access to the database e.g., via SQL injection, backup exposure, or insider access can extra...
CVE-2026-47702 TypeBot API tokens stored in plaintext
TypeBot is a chatbot builder tool. In version 3.16.1, API tokens bearer credentials used to authenticate against the builder API are stored in the database as cleartext strings. An attacker who gains read access to the database e.g., via SQL injection, backup exposure, or insider access can extra...
Microsoft Outlook Spoofing Vulnerability
Insufficiently protected credentials in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-72771
n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM nodes when user-supplied base or endpoint URLs are configured. Low-privileged workflow editors with use-only access to shared credentials can redirect requests to attacker-controlled hosts...
CVE-2026-72539 Windmill Labs Windmill - Information Disclosure
An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...
CVE-2026-72539 Windmill Labs Windmill - Information Disclosure
An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace...
CVE-2026-19391
A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords ldapdefaultauthtok and Pacemaker fence device credentials to be included in cleartext in archives uploaded to...
CVE-2026-19391
The CVE affects the insights-core password redaction layer, which does not recognize credentials beyond the literal string 'password'. This allows sensitive credentials such as SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in ar...
EUVD-2025-210675
In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted...
EUVD-2026-55866
SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to...
PT-2026-70869
Name of the Vulnerable Software and Affected Versions insights-client affected versions not specified Description A flaw exists where the application logs request headers upon receiving a non-200 response. This process may expose the cloud.openshift.com pull-secret token. A local user with access...
PT-2026-70889
When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...
PT-2026-70578
Name of the Vulnerable Software and Affected Versions Microsoft Office Outlook affected versions not specified Description Insufficiently protected credentials allow an unauthorized attacker to perform spoofing over a network. Spoofing is a technique where an attacker masquerades as another perso...
PT-2026-70848
An issue in MongoDB Server's intra-cluster connection setup could allow a party with suitable network access to influence which authentication mechanism is used when one replica set member connects to another. Under certain conditions, this could cause the cluster's shared internal credential to ...
PT-2026-70040
Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence Platform affected versions not specified Description SAP BusinessObjects Business Intelligence Platform stores sensitive credentials associated with user objects using a hard-coded cryptographic key. A...
PT-2026-70219
Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.17.0 Description TypeBot stores API tokens, which are bearer credentials used to authenticate against the builder API, as cleartext strings in the database. An attacker with read access to the database can extract...