CVE-2026-53603 nebula-mesh: Operator session tokens stored in plaintext in the database

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for ...

CVE-2026-53603 nebula-mesh: Operator session tokens stored in plaintext in the database

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for ...

CVE-2026-53603 nebula-mesh: Operator session tokens stored in plaintext in the database

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operatorsessions table the token column is the PRIMARY KEY. The session token is a 32-byte random hex value sent directly in a cookie and valid for ...

CVE-2026-53603

nebula-mesh , a self-hosted control plane for Slack Nebula mesh VPN, stored operator session tokens in plaintext in the operator_sessions table (the token column served as the PRIMARY KEY). Each token is a 32-byte random hex value delivered via cookie with a 24-hour validity. Unlike API keys and ...

CVE-2026-85588

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...

CVE-2026-19051

Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448...

CVE-2026-19051

Menulux Portal by Menulux Software Inc. is vulnerable to plaintext storage of a password , allowing an authenticated low-privilege attacker to retrieve embedded sensitive data over the network. The vulnerability affects versions prior to 20260903211448 . The CNA-assigned CVSS 3.1 score is 7.1 (Hi...

EUVD-2026-71039

Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448...

CVE-2026-19051 Plaintext Storage of User Credentials in Menulux Software's Menulux Portal

Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448...

CVE-2026-19051 Plaintext Storage of User Credentials in Menulux Software's Menulux Portal

Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448...

CVE-2026-85588 phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...

CVE-2026-85588 phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...

EUVD-2026-71011

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...

CVE-2026-85588

phpMyFAQ versions before 4.1.8 embed live TOTP shared secrets in plaintext inside user data export ZIP files. An attacker who obtains an exported archive can extract the TOTP seed and generate valid one-time codes, effectively bypassing two-factor authentication . The CVSS 4.0 base score is 5.3 (...

CVE-2026-85588 phpMyFAQ before 4.1.8 TOTP Secret Exposure via Data Export

phpMyFAQ versions before 4.1.8 include live TOTP shared secrets in plaintext within user data export ZIP files. Attackers obtaining exported archives can extract the TOTP seed and generate valid one-time codes to bypass two-factor authentication...

PT-2026-85488

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.8 Description User data export ZIP files contain live Time-based One-Time Password TOTP shared secrets in plaintext. An attacker who obtains these exported archives can extract the TOTP seed to generate valid...

PT-2026-85515

Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448...

EUVD-2026-71741

Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational...

PT-2026-86251

Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational...

CVE-2026-79390

Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational...