CVE-2026-19051 Plaintext Storage of User Credentials in Menulux Software's Menulux Portal

Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448...

CVE-2026-85588

phpMyFAQ versions before 4.1.8 embed live TOTP shared secrets in plaintext inside user data export ZIP files. An attacker who obtains an exported archive can extract the TOTP seed and generate valid one-time codes, effectively bypassing two-factor authentication . The CVSS 4.0 base score is 5.3 (...

The vulnerability of the bpf_selem_unlink() function in the kernel/bpf/bpf_local_storage.c module, which supports the BPF interpreter for the Linux operating system’s kernel, allows a malicious actor to trigger a service failure.

The vulnerability of the bpfselemunlink function in the kernel/bpf/bpflocalstorage.c module, which is part of the BPF interpreter support for the Linux operating system, is related to the occurrence of mutual locking. Exploiting this vulnerability could allow an attacker to trigger a service...

EUVD-2026-52279

SiYuan: Path Traversal via unvalidated avID in RenderAttributeView/AV read endpoints : reader-reachable cross-scope attribute-view disclosure...

CVE-2026-85211

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxyapi.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

EUVD-2026-70489

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxyapi.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

CVE-2026-85211

Label Studio through 1.23.0 is affected by a cross-organization storage URI resolution flaw in proxy_api.py endpoints. The root cause is a failure to apply organization filters when resolving storage URIs for tasks and projects, allowing an attacker with low privileges to access other tenants' cl...

CVE-2026-85211 Label Studio through 1.23.0 Cross-Organization Storage URI Resolution

Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxyapi.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents...

CVE-2026-15933

OptimiDoc Server On-Premise stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP for scan delivery, Active Directory for user list import, and SharePoint credentials, in cleartext via the web...

CVE-2021-38489

HDD password plaintext is stored in a UEFI variable...

CVE-2026-15933

OptimiDoc Server (On-Premise) stores credentials for external services in cleartext, allowing an authenticated administrator to view previously configured passwords—SMTP , FTP (scan delivery), Active Directory (user list import), and SharePoint —in cleartext through the web administration panel p...

EUVD-2026-70378

OptimiDoc Server On-Premise stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP for scan delivery, Active Directory for user list import, and SharePoint credentials, in cleartext via the web...

CVE-2026-15933 Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)

OptimiDoc Server On-Premise stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP for scan delivery, Active Directory for user list import, and SharePoint credentials, in cleartext via the web...

CVE-2021-38489

CVE-2021-38489 affects the HddPasswordPei driver in Insyde InsydeH2O 5.x firmware, as shipped in Siemens SIMATIC products. The root cause is that the HDD password is stored in plaintext within a UEFI variable, exposing it to attackers with local, high-privilege access. The vulnerability carries a...

EUVD-2021-34870

HDD password plaintext is stored in a UEFI variable...

CVE-2021-38489 HDD Password Stored In Plaintext

HDD password plaintext is stored in a UEFI variable...

CVE-2026-75136

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a...

CVE-2026-75136

UpSignOn for Windows versions prior to 7.19.0 contain an insecure credential storage flaw in the biometric unlock key managed via the Windows PasswordVault API. A local attacker running a standard process within the same Windows session can retrieve the key without triggering any authentication p...

EUVD-2026-70261

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a...

CVE-2026-75136 UpSignOn < 7.19.0 Biometric Key Exposure via Windows PasswordVault

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows PasswordVault API without triggering any authentication prompt. Attackers can access the stored biometric key from a...