CVE-2026-75057

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log...

CVE-2026-71566

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...

EUVD-2026-60205

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...

CVE-2026-71566

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the...

CVE-2026-14564

An Insufficiently Protected Credentials flaw in Logsign SIEM (versions 6.4.97 through 6.4.113) allows authenticated users with high privileges to retrieve embedded sensitive data. The vulnerability carries a CVSS 9.0 Critical rating (AV:N/AC:L/PR:H/S:C/C:H/I:H/A:L). Upgrade to Logsign SIEM 6.4.11...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

How MCP Servers Can Expose Enterprise Secrets

MCP servers can expose enterprise secrets through plaintext configuration files, over-permissioned access and prompt injection, often before security teams even know the server is running. As more organizations adopt AI agents into their systems, that exposure can silently become a major gap in M...

MAL-2026-14106 Malicious code in cloud-agen-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e57cfebf30bc4f71b96f08b04b1d0b7a0af0a7f32d11033a2c186e7692333e notify.js exports send, sendFile, sendPhoto, and log helpers that POST caller-supplied content to api.telegram.org using a hardcoded bot token and a...

Malicious code in cloud-agen-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e57cfebf30bc4f71b96f08b04b1d0b7a0af0a7f32d11033a2c186e7692333e notify.js exports send, sendFile, sendPhoto, and log helpers that POST caller-supplied content to api.telegram.org using a hardcoded bot token and a...

CVE-2026-74879 openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint

opensslencrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information including hostnames, IP addresses, connection...

CVE-2026-74873

The openssl_encrypt tool (before v1.4.0) passes --password values as visible process arguments, retrievable by any local user via ps aux or /proc/[pid]/cmdline, exposing plaintext and keystore passwords. CVSS 5.5 (local) / 8.7 (network). Upgrade to v1.4.0 or pass passwords via stdin/env instead o...

CVE-2026-13700

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the...

EUVD-2026-60057

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the...

CVE-2026-13700

The WooMS WordPress plugin (versions through 9.14) fails to validate a user-supplied URL before issuing server-side requests and attaches stored third-party integration credentials to each request. When the data-sync feature is enabled, unauthenticated attackers can perform Server-Side Request Fo...

CVE-2026-13700

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the...

BIT-CONSUL-2026-16496 terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability,...

Ivanti Endpoint Manager < 2024 SU7 Multiple Vulnerabilities

The version of Ivanti Endpoint Manager running on the remote host is prior to 2024 SU7. It is, therefore, affected by multiple vulnerabilities: - An out-of-bounds read in the Agent of Ivanti Endpoint Manager before version 2024 SU7 allows a remote unauthenticated attacker to crash an agent servic...

Unity Linux 20.1070a Security Update: libpq (UTSA-2026-099554)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099554 advisory. Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. Th...

PT-2026-76724

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as dict secure in glances/config.py checks only option names and exposes public username and credentials embedded in public api values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This...

CVE-2026-19726

The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts, allowing users with the Contributor role and above to read the full configuration of any chart on the site, including charts the Visualizer WordPress plugin before 4.0.7's own...