13551 matches found
CVE-2026-14019
An inappropriate implementation flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=517455455...
CVE-2026-14050
An insufficient policy enforcement flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=501708647...
CVE-2026-14102
An use after free flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513455047...
CVE-2026-14143
An incorrect security ui flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=514075028...
CVE-2026-15124
An insufficient policy enforcement flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=523735038...
CVE-2026-11841 CVE-2026-11841
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access witho...
CVE-2026-11841 CVE-2026-11841
An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access witho...
CVE-2026-14169
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...
CVE-2026-14169
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...
CVE-2026-14169 ads-tec Industrial IT: Account lockout via non-atomic user creation
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...
EUVD-2026-49730
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...
CVE-2026-15962
The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.2.6 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The...
CVE-2026-15962
CVE-2026-15962 affects the Fluent Forms Pro Add On Pack for WordPress (all versions up to 6.2.6). It enables PHP Object Injection through deserialization of untrusted input. An authenticated attacker with Subscriber-level access or higher can inject a PHP Object, with a POP chain allowing passwor...
CVE-2026-61886
Weintek cMT3092X HMI stores user account passwords in plaintext...
CVE-2026-61886
Weintek cMT3092X HMI is affected by CVE-2026-61886 due to plaintext storage of user account passwords. The vulnerability resides in how credentials are stored, enabling potential exposure of confidential data. Affected component: Weintek cMT3092X HMI (password storage mechanism). Root cause: plai...
CVE-2026-61886
Weintek cMT3092X HMI stores user account passwords in plaintext...
CVE-2026-65710 sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption
sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...
CVE-2026-65710 sysPass 3.2.11 Missing Authorization via PublicLinkController Account Decryption
sysPass through version 3.2.11 contains a missing authorization vulnerability that allows authenticated users with the PUBLICLINKCREATE profile flag to trigger unauthorized decryption and persistent storage of any vault account's password by exploiting the absence of AccountAcl checks in the publ...
EUVD-2026-48715
sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...
