10382 matches found
CVE-2026-76857 Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cgi
Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddnswanlistshow.cgi endpoint and related DDNSsetcgi, IGDGetCgiHandler, and IGDCgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing...
CVE-2026-68953
The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTPS requests...
[SECURITY] [DSA 6499-1] cjose security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6499-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 15, 2026 https://www.debian.org/security/faq -...
CVE-2026-73467
On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus TACACS+ servers...
CVE-2026-69212
Http4s (a Scala HTTP client/server library) is affected in its FollowRedirect client middleware. The root cause is that the middleware's authority comparison excludes the URI scheme when deciding whether to strip Authorization and Cookie headers on redirect. As a result, a same-authority redirect...
CVE-2026-73467
On affected Arista EOS versions, plaintext TACACS+ shared secrets may be written to agent log files when Tacacs trace level 6 is enabled on agent Aaa (CWE-532). Exploitation requires an attacker with authenticated local administrative shell access and the specific debug trace level explicitly ena...
EUVD-2026-79027
On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus TACACS+ servers...
CVE-2026-73467 On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers
On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus TACACS+ servers...
CVE-2026-73467 On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers
On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus TACACS+ servers...
CVE-2026-73466 On affected platforms running Arista EOS, under certain circumstances plaintext user passwords
On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...
CVE-2026-73466
CVE-2026-73466 affects Arista EOS , where plaintext user passwords may be written to log files (/var/log/agents/Aaa-*) under CWE-532 (Insertion of Sensitive Information into Log File). The precondition is that PyServer trace level 4 on agent Aaa is explicitly enabled via a non-standard debugging ...
CVE-2026-73466 On affected platforms running Arista EOS, under certain circumstances plaintext user passwords
On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...
CVE-2026-73465
CVE-2026-73465 is a CWE-532 (Insertion of Sensitive Information into Log File) vulnerability in Arista EOS . When MgmtSecuritySslCertKey trace levels 0, 3, and/or 4 are enabled on the ConfigAgent agent, plaintext RSA and EC private keys may be written to /var/log/agents/ConfigAgent-* log files. E...
EUVD-2026-79023
On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...
CVE-2026-73465 On affected platforms running Arista EOS, under certain circumstances plaintext private keys
On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...
EUVD-2026-78902
canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...
rabbitmq-server: rabbitmq-server: Information disclosure via unredacted credentials in Shovel crash logs
A flaw was found in rabbitmq-server. When the Shovel plugin worker process crashes due to network or connection failures, it fails to sanitize its internal state before logging error reports. As a result, sensitive connection details and unencrypted credentials, including plaintext passwords, are...
rabbitmq: RabbitMQ: Information disclosure of AMQP 1.0 shovel URI passwords
A flaw was found in RabbitMQ, a messaging and streaming broker. The AMQP 1.0 shovel component incorrectly stores connection Uniform Resource Identifiers URIs with embedded plaintext passwords. This information can be exposed to an authenticated attacker with monitoring privileges via the...
CVE-2026-91994
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...
CVE-2026-91994 Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...