n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mis...

CVE-2026-65599

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Goo

来源摘录 · NVD

n8n before 1.123.64 Credential Exposure via JWT Header

CVE-2026-65599

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Goo

历史摘要 · 未重新核验 · OSV.dev

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these re...

CVE-2026-13380

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthent

历史摘要 · 未重新核验 · NVD

A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an unknown functionality of the file zinnia/views/mixins/entry...

CVE-2026-16213

A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an un

历史摘要 · 未重新核验 · NVD

Fantomas42 django-blog-zinnia Protected Entry Password entry_protection.py cleartext storage

CVE-2026-16213

A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an un

历史摘要 · 未重新核验 · OSV.dev

nebula-mesh: Operator session tokens stored in plaintext in the database

CVE-2026-53603

## Impact Operator session tokens are stored in plaintext in the `operator_sessions` table (the `token` column is the P

历史摘要 · 未重新核验 · GitHub Advisory

Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root,...

CVE-2026-55885

Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download

历史摘要 · 未重新核验 · NVD

Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causi...

CVE-2026-8804

Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensiti

历史摘要 · 未重新核验 · NVD

Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

CVE-2026-50267

### Summary When MySQL or PostgreSQL service bindings from `VCAP_SERVICES` include TLS client credentials, the Connecto

历史摘要 · 未重新核验 · GitHub Advisory

Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and agent configurations...

CVE-2026-57287

Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secret

历史摘要 · 未重新核验 · NVD

nebula-mesh's stores enrollment tokens unhashed in SQLite

`internal/store/sqlite.go:1177,1192,1221,1245` — the `enrollment_tokens.token` column holds the raw UUID token. `Consume

历史摘要 · 未重新核验 · GitHub Advisory

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstractions 4.0.0 through...

CVE-2026-50267

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

历史摘要 · 未重新核验 · NVD

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strings in the api_toke...

CVE-2026-46622

SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API

历史摘要 · 未重新核验 · NVD

Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ti...

CVE-2026-10786

Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileg

历史摘要 · 未重新核验 · NVD

StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows...

CVE-2026-4387

StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication s

历史摘要 · 未重新核验 · GitHub Advisory

StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key mater...

CVE-2026-4387

该漏洞影响 Windows 平台上的 StrongDM Desktop Application 版本低于 23.74.0（Desktop Client 低于 53.77.0）。漏洞根源在于应用程序将用户的认证状态（包括 JSON Web T

历史摘要 · 未重新核验 · NVD

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive information leakage in log outputs. When the server is run with...

CVE-2026-45040

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive inform

历史摘要 · 未重新核验 · NVD

Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote authentic...

CVE-2026-8596

Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.

历史摘要 · 未重新核验 · NVD

CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected so...

CVE-2026-6332

CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive

历史摘要 · 未重新核验 · NVD

When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh)...

CVE-2026-42408

When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a high

历史摘要 · 未重新核验 · GitHub Advisory