Windows Hello Tampering Vulnerability

Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally...

Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges locally...

Windows Storage Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally...

firefox: thunderbird: Information disclosure in the Storage: IndexedDB component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Storage: IndexedDB component...

firefox: thunderbird: Information disclosure in the Storage: IndexedDB component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Storage: IndexedDB component...

CVE-2026-57263

CVE-2026-57263 affects LOGO! Soft Comfort for all versions

CVE-2026-19391

The CVE affects the insights-core password redaction layer, which does not recognize credentials beyond the literal string 'password'. This allows sensitive credentials such as SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in ar...

Zabbix - SAML SSO Authentication Bypass

When SAML SSO authentication is enabled non-default, session data can be modified by a malicious actor because a user login stored in the session was not verified. id: CVE-2022-23131 info: name: Zabbix - SAML SSO Authentication Bypass author: For3stCo1d,spac3wh1te severity: critical description:...

EUVD-2025-210675

In affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted...

EUVD-2025-210676

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to...

EUVD-2026-55880

SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt the stored credentials. Successful...

PT-2026-70447

Name of the Vulnerable Software and Affected Versions Windows Hello affected versions not specified Description Sensitive information is stored in cleartext, which allows an authorized attacker to perform local tampering to affect the system. Recommendations At the moment, there is no information...

PT-2026-70698

Name of the Vulnerable Software and Affected Versions Windows Storage Port Driver affected versions not specified Description A heap-based buffer overflow exists in the Windows Storage Port Driver. This issue occurs due to an integer overflow, which allows an authorized attacker to elevate...

PT-2026-70188

A vulnerability has been identified in LOGO! Soft Comfort All versions V9. The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allow an attacker who has obtained the project file to perform efficient offline dictionary or brute-force...

PT-2026-70394

Name of the Vulnerable Software and Affected Versions Azure Storage Explorer affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a condition where malicious scripts are injected into trusted websites. This allo...

PT-2026-70882

Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card to test candidate secrets offline and recover low-entropy ...

PT-2026-70461

Name of the Vulnerable Software and Affected Versions Windows Storage affected versions not specified Description A heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow occurs when a program writes more data to a...

PT-2026-70430

Name of the Vulnerable Software and Affected Versions Windows Storage affected versions not specified Description A heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow occurs when a program writes more data to a...

PT-2026-70219

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.17.0 Description TypeBot stores API tokens, which are bearer credentials used to authenticate against the builder API, as cleartext strings in the database. An attacker with read access to the database can extract...

CVE-2025-30240

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to...