MariaDB has cleartext password disclosure to a MITM on the initial-handshake
CVE-2026-55856
### Summary When a Java application connects with sslMode=verify-full (or verify-ca) and a password but does not pin a
#cwe-522
共收录 306 条相关情报。
← 返回所有主题MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials
CVE-2026-55854
### Summary When PAM (dialog) authentication is used, the connector can be coerced into sending the account password in
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the ...
CVE-2026-82288
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gra...
CVE-2026-82288
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled wit...
CVE-2026-55215
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to
gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after H...
CVE-2026-82255
gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where cr
gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. ...
CVE-2026-82247
gitoxide's gix-url crate (?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended h
gitoxide before 0.37.1 HTTP Basic credential leak via URL parsing
CVE-2026-82247
gitoxide's gix-url crate (?@ so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended h
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, a low-privilege API use...
CVE-2026-61802
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I
Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the risk of credential compromise through visual or remote ob...
CVE-2026-73839
Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the r
Wazuh discloses cleartext cluster key to low-privilege API users via GET /cluster/local/config
CVE-2026-61802
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
## Summary The PyPI account that publishes `pantheon-agents` was compromised in the June 2026 "Hades" PyPI supply-chain
NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials . A successful exploit of this vulnerability might lead to informatio...
CVE-2026-65087
NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials . A successf
urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through f...
CVE-2026-55553
urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prio
urllib's cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakage
CVE-2026-55553
## Summary urllib supports redirect-following through `followRedirect`, which is expected behavior for an HTTP client.
Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit...
CVE-2026-76846
Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access
Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and offsetexists() methods that lack field filtering. Attacke...
CVE-2026-76839
Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet() and
Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API...
CVE-2026-71511
Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticate
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation...
CVE-2026-78555
RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Althoug
Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticated attackers with member-read rights to retrieve bcrypt pa...
CVE-2026-71511
Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticate