An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords stored in or transmitted by GSS Deploym...

CVE-2026-101034

An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and

历史摘要 · 未重新核验 · NVD

FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

## Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affecte

历史摘要 · 未重新核验 · GitHub Advisory

HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending...

CVE-2026-21811

HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets acc

来源摘录 · NVD

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an u...

CVE-2026-114221

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can

来源摘录 · NVD

Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment status handler (HandleEnrollStatus at G...

CVE-2026-103090

Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control

来源摘录 · NVD

Unauthenticated Biscuit Credential Disclosure via GET /enroll/status in Google OSS Agent Mesh (SAM)

CVE-2026-103090

Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control

历史摘要 · 未重新核验 · OSV.dev

Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard...

CVE-2026-114070

Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that

历史摘要 · 未重新核验 · GitHub Advisory

Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor token in browser-readable s...

CVE-2026-114070

Trigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that

历史摘要 · 未重新核验 · NVD

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither the URL provided to libcurl nor t...

CVE-2026-94266

libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing credentia

来源摘录 · NVD

A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

CVE-2026-111765

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection(): connection.setInstanceFollowR

历史摘要 · 未重新核验 · GitHub Advisory

A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

CVE-2026-111763

*Impact.** A malicious or compromised A2A agent can cause the client's API key credential to be forwarded to an arbitrar

历史摘要 · 未重新核验 · GitHub Advisory

ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leaks account-level SAS token into every public attachment UR...

CVE-2026-113652

ApostropheCMS is an open-source Node.js content management system. From 1.25.0 until 1.28.0, uploadfs Azure backend leak

历史摘要 · 未重新核验 · NVD

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous ...

CVE-2026-111765

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to v

历史摘要 · 未重新核验 · NVD

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromised remote agent can cause the default JDK-based client to...

CVE-2026-111763

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromis

历史摘要 · 未重新核验 · NVD

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4...

CVE-2026-111927

Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper hostnam

历史摘要 · 未重新核验 · GitHub Advisory

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/container_registry_...

CVE-2026-96626

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and

来源摘录 · NVD

FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, se...

CVE-2026-109953

FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin o

历史摘要 · 未重新核验 · NVD

FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin

CVE-2026-109953

FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin o

历史摘要 · 未重新核验 · OSV.dev

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability...

CVE-2026-108904

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API client

历史摘要 · 未重新核验 · GitHub Advisory

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController:...

CVE-2026-108904

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API client

历史摘要 · 未重新核验 · NVD