MicroburstSecretsHunter

MicroBurst Secrets Hunter Un escáner de PowerShell que examina la salida de Get-AzDomainInfo de MicroBurst en busca de contraseñas en texto plano, claves, cadenas de conexión y otros secretos que nunca deberían permanecer sin cifrar en un entorno de Azure. Diseñado para flujos de trabajo de...

CVE-2026-105129 LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API

LaraDashboard before 1.4.8 contains an incorrect authorization vulnerability that allows authenticated users with only settings.view permission to read stored secrets through the settings API. Attackers can query GET /api/settings or /api/settings/optionname to retrieve plaintext AI provider API...

CVE-2026-103246

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification...

CVE-2026-103246 n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification...

CVE-2026-103246

The n8n workflow automation tool is vulnerable to Credential Disclosure in versions prior to 2.39.6 and 2.40.x before 2.40.1 . The root cause is a failure to validate credential ownership during inline agent node-tool introspection . An attacker can reference arbitrary credential IDs to decrypt a...

CVE-2026-103246: Authorization Bypass Through User-Controlled Key

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts without ownership verification...

CVE-2026-100862

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

EUVD-2026-87827

heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth values returned in cleartext by GET /api/workflows/id and persisted unsanitized into execution history, MCP API keys stored a...

CVE-2026-73467

On affected Arista EOS versions, plaintext TACACS+ shared secrets may be written to agent log files when Tacacs trace level 6 is enabled on agent Aaa (CWE-532). Exploitation requires an attacker with authenticated local administrative shell access and the specific debug trace level explicitly ena...

CVE-2026-73467 On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers

On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus TACACS+ servers...

CVE-2026-73467 On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers

On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus TACACS+ servers...

CVE-2026-91994

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

EUVD-2026-78434

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

CVE-2026-91994 Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

CVE-2026-91994

Semaphore UI through 2.19.12 contains a missing authorization vulnerability in the GetMustCanMiddleware component. The middleware exempts GET and HEAD requests from project resource permission checks, allowing attackers with guest or task_runner roles to read all project environments—including pl...

PT-2026-92383

Name of the Vulnerable Software and Affected Versions Arista EOS affected versions not specified Description On affected platforms running Arista EOS, plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus TACACS+ servers may be exposed under certain...

PT-2026-91934

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment...

CVE-2026-91994: Missing Authorization

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

CVE-2026-73604

Flowise before 3.1.3 contains an incomplete credential redaction vulnerability in the GET /api/v1/credentials/:id endpoint that returns decrypted secrets in plaintext. Authenticated users with credentials:view permission can retrieve sensitive data including database connection URLs with embedded...

CVE-2026-73604

Flowise (pre-3.1.3) has an incomplete credential redaction vulnerability in GET /api/v1/credentials/:id that exposes decrypted secrets to authenticated users with credentials:view. Impact described includes database connection URLs with passwords, cloud service account JSON with private keys, and...