HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/syst...

CVE-2026-46511

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing

历史摘要 · 未重新核验 · NVD

In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names

CVE-2026-49379

In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names

历史摘要 · 未重新核验 · GitHub Advisory

An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder ...

CVE-2026-42951

An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes accoun

历史摘要 · 未重新核验 · GitHub Advisory

StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key mater...

CVE-2026-4387

该漏洞影响 Windows 平台上的 StrongDM Desktop Application 版本低于 23.74.0（Desktop Client 低于 53.77.0）。漏洞根源在于应用程序将用户的认证状态（包括 JSON Web T

历史摘要 · 未重新核验 · NVD

In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names

CVE-2026-49379

In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names

历史摘要 · 未重新核验 · NVD

An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password hashes.

CVE-2026-42951

An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes accoun

历史摘要 · 未重新核验 · NVD

Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users wi...

CVE-2024-47271

Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-

历史摘要 · 未重新核验 · NVD

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through th...

CVE-2026-2255

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, e

历史摘要 · 未重新核验 · NVD

@hapi/wreck leaks sensitive `Proxy-Authorization` header across cross-hostname redirects

CVE-2026-44979

### Impact When `@hapi/wreck` follows a 3xx redirect to a different hostname, only the `Authorization` and `Cookie` head

历史摘要 · 未重新核验 · GitHub Advisory

Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiBurada allows Authe...

CVE-2025-13477

Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in

历史摘要 · 未重新核验 · NVD

The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to insufficient isolation of authenticatio...

CVE-2026-0393

The affected product may expose credentials remotely between low privileged visualization users during concurrent login

历史摘要 · 未重新核验 · NVD

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent...

CVE-2026-6345

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user pass

历史摘要 · 未重新核验 · GitHub Advisory

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker to impersonate a u...

CVE-2026-6345

Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user pass

历史摘要 · 未重新核验 · NVD

HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic authorization mechanisms may expose credentials to potential i...

CVE-2025-62312

HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic autho

历史摘要 · 未重新核验 · NVD

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_...

CVE-2026-43992

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens,

历史摘要 · 未重新核验 · NVD

sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)

CVE-2026-45091

In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret

历史摘要 · 未重新核验 · GitHub Advisory

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded JWT signing secret...

CVE-2026-42869

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57,

历史摘要 · 未重新核验 · NVD

@cyclonedx/cdxgen: Docker registry auth substring match forwards credentials to a different registry

# Docker registry auth substring match forwards credentials to a different registry ## Repository `cdxgen/cdxgen` ##

历史摘要 · 未重新核验 · GitHub Advisory

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following...

CVE-2026-41506

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-gi

历史摘要 · 未重新核验 · NVD

Argo vulnerable to exposure of artifact repository credentials

CVE-2026-42295

### Summary The workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service acc

历史摘要 · 未重新核验 · GitHub Advisory