SUSE CVE-2026-80255

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

PT-2026-88454

The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...

PT-2026-88524

Name of the Vulnerable Software and Affected Versions OpenIDC/cjose versions 0.6.1 through 0.6.2.5 Description When encrypting a JSON Web Encryption JWE using AES-CBC-HMAC content-encryption algorithms A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 combined with any key-management algorithm that...

PT-2026-88438

Name of the Vulnerable Software and Affected Versions Okta Hyperdrive Integration affected versions not specified Description The installer fails to mask the OAuth client secret when it is passed as an MSI property. This results in the credential being recorded in plaintext within the installer...

Moderate: pam security update

Pluggable Authentication Modules PAM provide a system to set up authentication policies without the need to recompile programs to handle authentication. Security Fixes: linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 For more details about the...

CVE-2026-80176

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure...

CVE-2026-80176

Dell Secure Connect Gateway 5.0 (SCG) Appliance and Application versions prior to 5.36.00.16 and 5.36.00.00, respectively, contain a Plaintext Storage of a Password vulnerability. A low-privileged attacker with local access could exploit this flaw, resulting in information disclosure . The CVSS v...

CVE-2026-80176

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure...

CVE-2026-80176

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure...

EUVD-2026-72524

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure...

PT-2026-86849

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure...

The vulnerability of the IBM Sterling Partner Engagement Manager software lies in the fact that critical information is transmitted in plaintext, allowing an intruder to gain unauthorized access to protected information.

The vulnerability of the IBM Sterling Partner Engagement Manager software lies in the transfer of critical information in plaintext. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2026-80176: Storing Passwords in a Recoverable Format

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure...

CVE-2026-80255

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

AZL-99828 CVE-2026-80255 affecting package rust 1.75.0-31

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

ALPINE-CVE-2026-80255

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

AZL-99810 CVE-2026-80255 affecting package mysql 8.0.46-1

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

CVE-2026-80255 secure cookie attribute bypass with tab

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

EUVD-2026-72151

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

CVE-2026-80255

The curl utility incorrectly handles the Set-Cookie: header when a horizontal tab (ASCII code 9) is used instead of a space (ASCII code 32) before the Secure attribute. This parsing error causes curl to store the cookie without the Secure flag, potentially leading to the cookie being transmitted ...