CVE-2026-105138 Obot 0.12.0 before 0.26.2 Credential Exposure via MCP Catalog Entry API

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/entryid t...

CVE-2026-93026

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

CVE-2026-93026

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

CVE-2026-93026

This vulnerability in Veeam Backup & Replication allows an authenticated user with the Backup Viewer role to modify or delete the Enterprise Manager master key and read or overwrite stored antivirus update credentials on the Veeam Backup Server. The issue impacts Veeam Backup & Replication 12.3.2...

EUVD-2026-94227

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

CVE-2026-93026

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

CVE-2026-96530 Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials...

EUVD-2026-94189

The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials...

EUVD-2026-94129

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials...

CVE-2026-16528

Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS...

CVE-2026-16528

Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS...

CVE-2026-16528

Certain ASUS router models are vulnerable to the insertion of sensitive information into log files . A remote authenticated attacker can access DDNS credentials from the system log, which may allow for the subsequent modification of DNS settings . Remediation details are available in the Security...

CVE-2026-16528

Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS...

EUVD-2026-94156

Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the system log, potentially enabling modification of DNS settings.Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS...

CVE-2026-101331

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials...

PT-2026-107591

Name of the Vulnerable Software and Affected Versions Homer versions prior to 11.0.283 Description In fresh deployments using internal authentication, the bootstrap process automatically creates an admin account with a hard-coded password sipcapture. This password is stored as a legacy SHA-256 he...

CVE-2026-76483: Insufficiently Protected Credentials

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem SSM On-Prem, has conducted a comprehensive internal security review. This review resulted in software hardening releases...

CVE-2026-62252: Use of Hard-coded Credentials

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...

CVE-2026-93026: Missing Authorization

This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials...

CVE-2026-101331: Insufficiently Protected Credentials

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials...