CVE-2026-92680: Insufficiently Protected Credentials

Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials the target use...

EUVD-2026-44812

9router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade...

CVE-2026-90985

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products...

CVE-2026-90985 WPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure via woosc_load

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products...

CVE-2026-90985 WPC Smart Compare for WooCommerce < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure via woosc_load

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products...

WordPress WPC Smart Compare for WooCommerce plugin < 6.6.1 - Unauthenticated Password-Protected Product Description Disclosure vulnerability

Unauthenticated Password-Protected Product Description Disclosure vulnerability discovered by Artus KG in WordPress Plugin WPC Smart Compare for WooCommerce versions 6.6.1...

EUVD-2026-85055

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products...

EUVD-2026-84954

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information due to insufficiently protected credentials...

EUVD-2026-84964

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials...

CVE-2026-90985: Exposure of Sensitive Information to an Unauthorized Actor

The WPC Smart Compare for WooCommerce WordPress plugin before 6.6.1 does not apply WordPress's post-password protection when returning product content through its comparison handler, allowing unauthenticated users to read the description of password-protected products...

CVE-2026-81208: Insufficiently Protected Credentials

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow an authenticated user to access sensitive information due to improper handling of encrypted credentials. An attacker could exploit this vulnerability to obtain credentials intended for other users or environments...

CVE-2026-18124

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information due to insufficiently protected credentials...

CVE-2026-17643

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials...

CVE-2026-18124

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by a vulnerability where a local attacker can obtain sensitive information due to insufficiently protected credentials (CWE-522 ). This issue affects versions 4.0.6.0 through 4.0.10.0 (including specific iFix releases). The ...

CVE-2026-18124 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information due to insufficiently protected credentials...

CVE-2026-17643 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials...

CVE-2026-79313

webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can...

CVE-2026-18124: Insufficiently Protected Credentials

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information due to insufficiently protected credentials...

PT-2026-96935

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTP CLIENT IP and HTTP X FORWARDED FOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout...

CVE-2026-79313

The webpy web.py 0.76 framework is vulnerable to Insufficient Session Expiration . The root cause is that session management relies on periodic cleanup to expire sessions rather than verifying the last-access time when a session is loaded. This allows an attacker who possesses a previously valid ...