CVE-2026-103548 Improperly Stored Credentials

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

CVE-2026-103548 Improperly Stored Credentials

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

CVE-2026-103548

The Itron MV-90 xi 3.0 contains improperly stored passwords within its configuration file. This vulnerability allows an attacker to decode both current passwords and password histories, potentially granting unauthorized access to the MV-90 application as any user. No specific remediation steps or...

EUVD-2026-90023

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials...

CVE-2026-100279

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials...

Ivanti Endpoint Manager - Authentication Bypass

Ivanti Endpoint Manager 2024 SU5 contains an authentication bypass caused by improper access control, letting remote unauthenticated attackers leak stored credential data, exploit requires no special privileges. id: CVE-2026-1603 info: name: Ivanti Endpoint Manager - Authentication Bypass author:...

EUVD-2026-89456

Pausing a shared public dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credential...

CVE-2019-18988

CVE-2019-18988 Descifrado de credenciales almacenadas de TeamViewer...

CVE-2026-94611

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94611 authentik: Stored credentials are readable with view permission alone

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

CVE-2026-94611 authentik: Stored credentials are readable with view permission alone

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credentials when an account has view permission on an affected configuration, even when that account is not authorized to change the configuration or read its secrets...

PT-2026-98034

Name of the Vulnerable Software and Affected Versions authentik versions prior to 2026.2.7 authentik versions prior to 2026.5.7 authentik versions prior to 2026.8.2 Description API serializers return stored credentials when an account possesses view permission on specific configurations, regardle...

CVE-2026-92808

CVE-2026-92808 is a server-side request forgery (SSRF) vulnerability in the UnifiedLogin service of Altium Enterprise Server . An unauthenticated network attacker can force the server to issue outbound HTTP requests to arbitrary destinations, including internal services reachable only from the se...

CVE-2026-82583: Improper Neutralization of Special Elements used in an SQL Command

NextGen Connect Mirth Connect versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, which could result in disclosure of stored credentials for connected systems, arbitrary file write, and a denial-of-service condition...

BIT-AUTHENTIK-2026-61574 authentik RAC: access any endpoint via an unrelated application

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain...

PT-2026-79843

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain...

CVE-2026-76260

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the restpropertiesget capability could read encrypted stored credentials through the Representational State Transfer REST API. Successful exploitation can expose relevant data protected by the...

CVE-2026-76339

In Splunk Enterprise below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, the geostats command fails to validate input, allowing a low-privileged user to inject arbitrary SPL that executes under another user's permissions after phishing. CVSS 5.4 (MEDIUM); no exploitation evidence provided. Upgrade to affec...

CVE-2026-76260

CVE-2026-76260 is an incorrect permission assignment vulnerability in Splunk Enterprise affecting versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14 . The properties REST endpoint checks for the rest_properties_get capability instead of the more restrictive list_storage_passwords capability, allow...

CVE-2026-76260 Incorrect Permission Assignment for Critical Resource through the REST API in Splunk Enterprise

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the restpropertiesget capability could read encrypted stored credentials through the Representational State Transfer REST API. Successful exploitation can expose relevant data protected by the...