CVE-2026-103097 is a high-severity vulnerability in GeoVision Inc.'s GV-Eye Android application version 3.6.0. The issue involves a hardcoded API key embedded within the application package, which can be extracted through reverse engineering. This exposure allows unauthorized users to misuse the API key, potentially leading to unauthorized access to services relying on this key. The vulnerability does not affect confidentiality of user data directly but compromises the security of the API key itself.
CVE-2026-103096 is a vulnerability in GeoVision Inc.'s GV-Eye Android application version 3.6.0 where an API key is hardcoded and can be extracted from the application package. Because Android apps can be reverse engineered, this allows unauthorized users to retrieve and misuse the embedded API key. The vulnerability has a high severity with a CVSS score of 7.5, indicating a network attack vector with no privileges or user interaction required and high confidentiality impact. No official patch or remediation guidance is currently provided by the vendor. Users should check for vendor advisories for updates and avoid distributing the vulnerable version until a fix is available.
CVE-2026-100288 is a vulnerability in Devolutions Server versions prior to 2026.3.7.0 where sensitive information, including external identity provider tokens and active session identifiers, is stored in cleartext within the database. An attacker with read access to the database can directly inspect these records to obtain this sensitive data. The vulnerability has a high severity with a CVSS score of 7.2.
RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site. This issue is fixed in versions 4.2.8 and 4.3.2.
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
CVE-2026-77250 is a vulnerability in sooperset's mcp-atlassian server prior to version 0.22.0 where OAuthConfig stores access and refresh tokens in cleartext files under the user's .mcp-atlassian directory. On systems with permissive file permissions, other local users or processes can read these tokens and potentially reuse them to access Atlassian services. This issue is fixed in version 0.22.0.
A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the database can then read values that were intended to be protected from that party. This may result in unintended disclosure of sensitive information.
Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can therefore store values intended to be encrypted in readable form, with no error or warning. A party with routine read access to the database, a backup, or the underlying data files may then see data that was meant to remain unreadable outside the application.
The CareCam HMT.CM2507 IP camera firmware version 251211.1507 stores configured wireless network credentials in cleartext within the device filesystem. This vulnerability (CWE-312) allows an attacker with filesystem access—via physical access, debugging interfaces, or other vulnerabilities—to retrieve the network SSID and pre-shared key. The vulnerability has a critical CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attacker with minimal access could obtain the token to gain unauthorized access or escalate privileges within the observability environment.
Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the device to retrieve the credentials stored by the application and impersonate the user account.
CVE-2026-4130 is a vulnerability in NI SystemLink and NI SystemLink Server versions prior to 26.5.0 that involves the cleartext storage of sensitive information. An attacker with local access could exploit this flaw to obtain sensitive data stored unencrypted by the system. This issue has been assigned a high severity rating with a CVSS score of 7.1. The vulnerability is fixed in version 26.5.0.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
A vulnerability in forgekeep nebula-mesh prior to version 0.3.8 allows cleartext storage of operator session tokens in the database. These tokens, used for operator authentication, are stored in plaintext in the operator_sessions table, enabling anyone with database read access to hijack active sessions without further authentication. The issue has been fixed in version 0.3.8.
Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.
CVE-2026-77975 affects the Ebyte NE2-D11 Firmware version 9013-2-17. The vulnerability involves exporting administrative credentials and sensitive configuration information without adequate protection. An unauthenticated attacker on the adjacent network who obtains the exported configuration file could recover valid credentials and access the device or similarly configured systems. The CVSS score is 6.5, indicating a medium severity vulnerability with high confidentiality impact but no integrity or availability impact.
CVE-2026-77970 is a medium severity vulnerability in ash-project's ash_paper_trail component that causes cleartext storage of sensitive information. The vulnerability arises because sensitive attributes are only redacted at the top-level resource, while embedded, union, or list values containing sensitive data are stored in cleartext in the version table. This affects versions from 0.3.0 up to but not including 0.7.0. No official patch or remediation guidance is currently available.
CVE-2026-75847 is a medium severity vulnerability in ash-project's ash_paper_trail component that causes sensitive attribute values to be stored in cleartext within the generated version resource. This occurs because the changes map storing these values is marked as not sensitive, leading to exposure in default read actions, logs, and error messages. The issue affects versions from 0.1.1 up to but not including 0.7.0.