8635 matches found
Siemens SIMATIC S7-1500 CPU 1518 MFP Plaintext Storage of a Password (CVE-2026-23370)
This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505620; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...
Linux Distros Unpatched Vulnerability : CVE-2026-59847
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an...
CVE-2026-61886
Weintek cMT3092X HMI stores user account passwords in plaintext...
CVE-2026-61886 Weintek cMT3092X Plaintext Storage of a Password
Weintek cMT3092X HMI stores user account passwords in plaintext...
CVE-2026-61886
Weintek cMT3092X HMI is affected by CVE-2026-61886 due to plaintext storage of user account passwords. The vulnerability resides in how credentials are stored, enabling potential exposure of confidential data. Affected component: Weintek cMT3092X HMI (password storage mechanism). Root cause: plai...
GHSA-PVCR-8MVP-W8QR Budibase: Chat-Link Handoff Identity Confusion (Same-Tenant Account-Link CSRF)
Summary The Budibase AI chat-link handoff flow GET/POST /api/chat-links/:instance/:token/handoff binds an external chat identity Slack/Discord/MS Teams/Telegram to a Budibase user account. The confirmation endpoint is on a public route no CSRF middleware, no auth-group gate and the only credentia...
EUVD-2026-48445
Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...
PT-2026-64424
Name of the Vulnerable Software and Affected Versions Weintek cMT3092X affected versions not specified Description The HMI stores user account passwords in plaintext, which allows an attacker with access to the storage to retrieve sensitive credentials. Recommendations At the moment, there is no...
CVE-2026-40430
Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...
CVE-2026-40430
Pronetiqs IntraVUE is affected. Versions 3.2.1a14 and earlier store passwords in plaintext, exposure of cleartext credentials via the API. Root cause is plaintext credential storage; impact is potential credential disclosure through API access. No exploitation details are provided in the document...
CVE-2026-40430 Plaintext Storage of a Password in Panduit IntraVUE by Pronetiqs
Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API...
CVE-2026-47755
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal wit...
CVE-2026-47755
CVE-2026-47755 : ITFlow prior to v26.05 is vulnerable to authenticated cross-tenant credential disclosure. A low-privileged authenticated agent can fetch plaintext credentials and TOTP secrets of another client by loading the credential edit modal for an arbitrary credential_id due to missing cli...
PT-2026-64196
Name of the Vulnerable Software and Affected Versions Pronetiqs IntraVUE versions prior to 3.2.1a14 Description The software stores passwords in plaintext, which could lead to the exposure of cleartext credentials through the API. Recommendations Update to a version newer than 3.2.1a14...
GHSA-89GH-3PGC-V5H2 n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
Impact Custom HTTP headers configured in credentials for certain LLM sub-nodes including OpenAI, Anthropic, and Lemonade are masked in the n8n UI but are written in plaintext into execution data during workflow runs. Any authenticated user with access to the execution data for an affected workflo...
n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
Impact Custom HTTP headers configured in credentials for certain LLM sub-nodes including OpenAI, Anthropic, and Lemonade are masked in the n8n UI but are written in plaintext into execution data during workflow runs. Any authenticated user with access to the execution data for an affected workflo...
NPM: n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
NPM: n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...
GHSA-2434-3X6Q-8R99 n8n: External Secrets Accessible via Workflow Expressions Outside Credentials
Impact External secrets were incorrectly resolved in workflow node expressions, where they are not intended to be available. An authenticated user with project editor access could read the plaintext value of external secrets by referencing them in a node expression, without needing explicit secre...