OpenBSD LibreSSL encryption issue vulnerability

OpenBSD LibreSSL versions 4.4.0 and earlier contain an encryption vulnerability. This vulnerability arises because url2host discards the OCSP URL scheme, and httpalloc selects TLS only for port 443, resulting in plaintext transmission. Network attackers can read the OCSP request sent to the URL o...

WatchGuard Mobile VPN with SSL Client encryption issue vulnerability

A vulnerability related to encryption issues exists in WatchGuard Mobile VPN with SSL Client versions from 12.0 up to and including 2026.4. This vulnerability stems from the transmission of sensitive information in plaintext, allowing local attackers to capture loopback traffic and obtain users’...

Florent Clairambault ftpserverlib encryption issue vulnerability

Florent Clairambault ftpserverlib versions 0.32.4 and earlier contain an encryption vulnerability. This vulnerability arises because TransferOpen only checks the transferTLS flag set by PROT; it fails to verify whether the prepared data connection utilizes TLS. When a client sends a PROT P after...

HCL AppScan Integration with Azure Boards for ASoC & A360 encryption issue vulnerability

The HCL AppScan Integration with Azure Boards for ASoC & A360 version 1.0.0 contains an encryption-related vulnerability. This vulnerability arises when sensitive information is transmitted in plaintext via HTTP to the AppScan server, potentially allowing attackers to intercept credentials or...

EUVD-2026-97964

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls synctrue before a user sets an encryption password, causing the operation-upload path to transmit and store all use...

Frank Fiegel mcp-remote encryption vulnerability

Frank Fiegel’s mcp-remote software, versions 0.8.0 to 0.14.3, has encryption-related vulnerabilities. This issue arises from the fact that authorizeWithDeviceCode does not enforce the use of an HTTPS endpoint. When device authorization and token endpoints are non-loopback HTTP URLs, the client ke...

curl: Cookie attribute truncation in curl drops Secure/HttpOnly protections

Description: If a Set-Cookie header contains an = immediately after a semicolon i.e., ;=, curl stops parsing the attributes and discards everything that follows. This silently drops protections like Secure and HttpOnly, causing curl to later send the cookie over unencrypted HTTP. Root Cause: In...

CVE-2026-103098

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...

CVE-2026-103098

The GV-Eye software is vulnerable to sensitive information exposure due to the transmission of a sensitive key within the URL query parameter over an unencrypted HTTP connection. Because the request is sent in plaintext rather than via HTTPS, an attacker capable of monitoring network traffic can ...

EUVD-2026-91148

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...

CVE-2026-103098 GV-Eye Sensitive information exposure in URL query parameter Vulnerability

Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key...

PT-2026-104063

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A sensitive key is transmitted in the URL over an unencrypted HTTP connection. Because the request uses HTTP instead of HTTPS, the key is sent in plaintext acro...

CVE-2026-69212

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison excludes the URI scheme. A same-authority redirect from HTTPS to HTTP...

CVE-2026-69212

Http4s (a Scala HTTP client/server library) is affected in its FollowRedirect client middleware. The root cause is that the middleware's authority comparison excludes the URI scheme when deciding whether to strip Authorization and Cookie headers on redirect. As a result, a same-authority redirect...

PT-2026-92404

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison excludes the URI scheme. A same-authority redirect from HTTPS to HTTP...

IBM Sterling Partner Engagement Manager Plaintext Transmission

The vulnerability of the IBM Sterling Partner Engagement Manager software lies in the transfer of critical information in plaintext. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

EUVD-2026-72151

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

CVE-2026-79390: Improper Access Control

Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational...

CVE-2026-19854

When the ClickHouse plugin uses Native protocol the default with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to ClickHouse in the clear. Username, password, queries, and results can be read on the hop after the proxy. The server certificate is never...

Windows Ancillary Function Driver Disclosure

The vulnerability of the Windows Ancillary Function Driver for WinSock operating systems is related to the transmission of critical information in open text. Exploiting this vulnerability can allow an attacker to disclose protected information...