NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plai...

CVE-2026-86175

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authen

历史摘要 · 未重新核验 · NVD

NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

CVE-2026-86175

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authen

历史摘要 · 未重新核验 · OSV.dev

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key a...

CVE-2026-72793

**CVE:** This vulnerability corresponds to [CVE-2026-72793](https://nvd.nist.gov/vuln/detail/CVE-2026-72793). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

SiYuan: The session-cookie signing key (Conf.CookieKey) is returned to anonymous readers by /api/system/getConf

CVE-2026-72794

**CVE:** This vulnerability corresponds to [CVE-2026-72794](https://nvd.nist.gov/vuln/detail/CVE-2026-72794). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintext in the operator_sessions table (the...

CVE-2026-53603

nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens ar

历史摘要 · 未重新核验 · NVD

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authenticated user to read admin-defined API keys. Attackers with ...

CVE-2026-85700

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authentic

历史摘要 · 未重新核验 · NVD

Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints

CVE-2026-85700

Onyx 4.6.6 fails to properly restrict access to custom tool credentials stored in custom_headers, allowing any authentic

历史摘要 · 未重新核验 · OSV.dev

SiYuan: Encrypted-notebook key-derivation material and wrapped notebook keys disclosed to anonymous readers, enabling offline master-password cracking

CVE-2026-72801

**CVE:** This vulnerability corresponds to [CVE-2026-72801](https://nvd.nist.gov/vuln/detail/CVE-2026-72801). ### Summa

历史摘要 · 未重新核验 · GitHub Advisory

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the...

CVE-2026-8862

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code,

历史摘要 · 未重新核验 · GitHub Advisory

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container registry. ...

CVE-2026-8862

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code,

历史摘要 · 未重新核验 · NVD

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that...

CVE-2026-75136

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to

历史摘要 · 未重新核验 · GitHub Advisory

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometric unlock key stored in the Windows P...

CVE-2026-75136

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to

历史摘要 · 未重新核验 · NVD

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

## Summary pnpm expands `${VAR}` environment placeholders in the `httpProxy` / `httpsProxy` / `noProxy` settings read f

历史摘要 · 未重新核验 · GitHub Advisory

MySQL2: Auth Plugin Downgrade to mysql_clear_password Leaks Plaintext Credentials

## Summary A rogue MySQL server (or MITM) can force mysql2 to send credentials in **plaintext** by requesting an auth s

历史摘要 · 未重新核验 · GitHub Advisory

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text password authenticatio...

CVE-2026-55860

MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2db

历史摘要 · 未重新核验 · NVD

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog authentication can be ...

CVE-2026-55857

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3

历史摘要 · 未重新核验 · NVD

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, when a Java application connects ...

CVE-2026-55856

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3

历史摘要 · 未重新核验 · NVD

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js...

CVE-2026-55854

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to

历史摘要 · 未重新核验 · NVD

org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

CVE-2026-55860

### Summary The connector does not gate clear-text password authentication plugins on transport encryption. A hostile o

历史摘要 · 未重新核验 · GitHub Advisory

org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

CVE-2026-55857

### Summary When PAM (dialog) authentication is used, the connector can be coerced into sending the account password in

历史摘要 · 未重新核验 · GitHub Advisory