10813 matches found
CVE-2026-41874: Plaintext Storage of a Password
Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor assessed the likelihood of exploitation as very low and...
CVE-2026-48025: Improper Clearing of Heap Memory Before Release
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, internal/pki/resolver.go:36-64 constructs a CAManager with the plaintext ed25519.PrivateKey after unwrapping via the master key; internal/pki/ca.go:13-16 stores it. Callers at...
PT-2026-65453
Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor assessed the likelihood of exploitation as very low and...
Switch discovery credentials can be seen in plain text inside sannavswapfie
A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the Brocade SANnav Virtual Machine VM. This can happen when the SANnav server encounters an Out Of Memory OOM condition. The...
OSEC-2026-12 AEAD `decrypt_into` functions writes plaintext before checking the tag
On the generic GCM path, AES.GCM.authenticatedecryptinto as well as Chacha20.authenticatedecryptinto and AES.CCM16.authenticatedecryptinto writes the decrypted plaintext into the caller's destination buffer and only then compares the tag. On a forged tag the function returns false, but the...
CVE-2026-17570
Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server 2026.1.23.0...
CVE-2026-17570
Devolutions Server is impacted by CVE-2026-17570 , a vulnerability caused by improper access control in the PAM password history endpoints . This flaw allows an authenticated low-privileged user to disclose plaintext credential secrets by sending crafted API requests. The issue affects Devolution...
CVE-2026-17570
Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server 2026.1.23.0...
EUVD-2026-49380
Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server 2026.1.23.0...
CVE-2026-17570
Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server 2026.1.23.0...
CVE-2026-17570: Authorization Bypass Through User-Controlled Key
Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server 2026.1.23.0...
PT-2026-65082
Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 Devolutions Server versions 2026.1.23.0 and earlier Description Improper access control in the PAM password history endpoints allows an authenticated low-privileged user to disclose...
Siemens SIMATIC S7-1500 CPU 1518 MFP Plaintext Storage of a Password (CVE-2026-23370)
This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505620; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...
EUVD-2026-48748
Weintek cMT3092X HMI stores user account passwords in plaintext...
Linux Distros Unpatched Vulnerability : CVE-2026-59847
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an...
CVE-2026-61886
Weintek cMT3092X HMI stores user account passwords in plaintext...
CVE-2026-61886 Weintek cMT3092X Plaintext Storage of a Password
Weintek cMT3092X HMI stores user account passwords in plaintext...
CVE-2026-61886
Weintek cMT3092X HMI is affected by CVE-2026-61886 due to plaintext storage of user account passwords. The vulnerability resides in how credentials are stored, enabling potential exposure of confidential data. Affected component: Weintek cMT3092X HMI (password storage mechanism). Root cause: plai...
