CVE-2026-73465: Insertion of Sensitive Information into Log File

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

CVE-2026-46488: Plaintext Storage of a Password

motionEye mEye is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meyeusername and meyepasswordhash cookies as authentication material without server-side session...

PT-2026-92404

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison excludes the URI scheme. A same-authority redirect from HTTPS to HTTP...

PT-2026-93191

Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddns wan list show.cgi endpoint and related DDNSset cgi, IGD GetCgiHandler, and IGD CgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing...

CVE-2026-76857: Insufficiently Protected Credentials

Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddnswanlistshow.cgi endpoint and related DDNSsetcgi, IGDGetCgiHandler, and IGDCgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing...

CVE-2026-91994: Missing Authorization

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

CVE-2026-68953: Missing Authentication for Critical Function

The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTPS requests...

PT-2026-92381

Name of the Vulnerable Software and Affected Versions Arista EOS affected versions not specified Description On affected platforms, plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled...

CVE-2026-55102

CVE-2026-55102 affects hashi-vault-js , a Node.js module for interacting with the HashiCorp Vault API, in versions prior to 0.5.2 . Every API method in src/Vault.js rethrows the raw AxiosError via parseAxiosError(), retaining the full Axios configuration including the X-Vault-Token header and err...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: Do not log plaintext credentials in cifssetcifscreds When debug logging is enabled, cifssetcifscreds logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing...

Astra Linux – Vulnerability in mbedtls

A issue was discovered in Mbed TLS before version 2.24.0 and before versions 2.16.8 LTS and 2.7.17 LTS. There is a lack of zeroization of plaintext buffers in mbedtlssslread, which is necessary to erase unused application data from memory...

Astra Linux – Vulnerability in libgcrypt20

The ElGamal implementation in Libgcrypt before version 1.9.4 allows plaintext recovery. This occurs because, during interaction between two cryptographic libraries, a dangerous combination of elements arises—specifically, the prime number defined by the receiver’s public key, the generator define...

Astra Linux – Vulnerability in Thunderbird

Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird versions earlier than 128.4.3 and Thunderbird version 132.0.1...

Astra Linux – Vulnerability in Linux

A issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept second or subsequent broadcast fragments even when sent in plaintext and process them as fully unfragmented frames. An adversary can exploit this vulnerability to inject arbitrary...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Platform/x86: dell-wmi-sysman: Do not perform hex dumping of plaintext password data. The setnewpassword function performs hex dumping of the entire buffer, which contains plaintext password data, including current and new...

Astra Linux – Vulnerability in Samba

A flaw was discovered in the way Samba implemented SMB1 authentication. An attacker could exploit this flaw to retrieve the plain-text password sent over the network, even if Kerberos authentication was required...

Astra Linux – Vulnerability in OpenSSL

There exists a timing-based side channel in the OpenSSL RSA Decryption implementation. This vulnerability could be sufficient for an attacker to recover plaintext across a network in a Bleichenbacher-style attack. To successfully decrypt data, an attacker would need to be able to send a very larg...

Astra Linux – Vulnerability in Thunderbird

If a Thunderbird user responded to a crafted HTML email containing a meta tag, where the meta tag had the http-equiv="refresh" attribute, and the content attribute specified a URL, then Thunderbird would initiate a network request to that URL, regardless of any configuration settings that block...

TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record. For example, a plaintext EncryptedExtensions message packed into the same record as the ServerHello was accepted. RFC 8446 section 5.1 requires that handshak...

CVE-2026-82783

Plaintext storage of a password issue exists in CONPROSYS nano Series . If this vulnerability is exploited, an attacker with physical access to the product may obtain credentials...