IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with a read or share grant on a target flow to retrieve the flow owner's stored third-party credentials in cleartext from the API response.
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.
A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery).
CVE-2026-87097 is a vulnerability in Acronis Cyber Protect 17 (Linux and Windows) before build 42587 that involves insufficiently protected credentials, leading to sensitive information disclosure. The flaw is classified under CWE-522. The vulnerability has a CVSS 3.0 base score of 5.3, indicating medium severity. A fix is available in build 42587.
Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated remote attackers to escalate privileges via authentication abuse to access the access keys, secret keys, and deployment secrets
A vulnerability in nuxt-ollama prior to version 1.3.1 causes the cloud API key to be exposed in plaintext within the server-rendered HTML. This occurs because the module options, including the api_key, are merged into a public runtime configuration that Nuxt serializes into the page payload. An attacker can steal this key and make unauthorized cloud API requests, potentially exhausting quotas and accessing sensitive stored data. The issue is fixed in version 1.3.1.
The CTFer.io terraform-provider-ctfd versions from 0.1.5 up to but not including 2.8.2 store the ctfd_team.password in Terraform state as a non-sensitive value. This allows any user with access to the Terraform state file to read team passwords without needing to decrypt them. The issue is resolved in version 2.8.2.
CVE-2026-101034 is a vulnerability in Broadcom Symantec Ghost Solution Suite where hardcoded keys allow attackers to decrypt sensitive credentials such as domain/service account passwords, task run-as credentials, and sysprep passwords stored or transmitted by the GSS Deployment Server installation. This exposure could lead to unauthorized access to critical system credentials.
Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basic_auth and cookie credentials of a request via a same-host redirect to another scheme or port. With follow_redirect enabled, hackney:follow_redirect/10 in src/hackney.erl reissues the request to the Location target after hackney:maybe_strip_auth_on_redirect/3, which compared only the hostname of the current and the redirect URL. A redirect from https to http on the same host resent the Authorization and Cookie headers in cleartext, where an on-path attacker can read them, and a redirect to another port on the same host handed them to a different service. location_trusted forwards credentials to any target by design and is unchanged.
This issue affects hackney: from 2.0.0 before 4.9.0.
HCL AppScan Azure Boards Plugin has an information disclosure vulnerability where secrets may be exposed in plaintext during pipeline execution. These secrets can appear in task outputs, debug logs, environment variable dumps, or build agent scripts, even though they are masked in the user interface. The vulnerability arises from insufficient protection of credentials in the integration with Azure Boards for ASoC & A360.
NT OneAPP by NewType Infortech contains a credential disclosure vulnerability (CWE-522) that allows unauthenticated remote attackers to trigger an HTTP Basic Authentication challenge from an unvalidated source within the WebView. This can lead to disclosure of the NUP Portal passcode of a logged-in user under specific conditions. The vulnerability affects versions from 0 up to and including 1.5.22. The CVSS 4.0 base score is 5.9, indicating a medium severity risk.
CVE-2026-103090 affects Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8. It involves missing authentication and insufficient credential protection in the control plane enrollment status handler, allowing unauthenticated attackers to retrieve signed identity tokens and replay them to access or modify mesh policies and router information. The issue is fixed in version 0.1.0-alpha.9, which adds cryptographic proof requirements, rate limiting, and validation of router lease addresses.
CVE-2026-94266 is a vulnerability in libcurl where the function curl_easy_getinfo() with the CURLINFO_EFFECTIVE_URL option may return a URL containing credentials, even if the original or redirected URLs did not include them. This could lead to unintended exposure of sensitive credentials.
ApostropheCMS versions from 1.25.0 up to but not including 1.28.0, when configured with the Azure backend and SAS tokens enabled, leak account-level SAS tokens in public attachment URLs. This exposure occurs because the BlobServiceClient is constructed from a URL embedding the full SAS query string, which is then inherited by Azure SDK clients. The issue is fixed in version 1.28.0 and later.
CVE-2026-111765 is a vulnerability in the a2a-java SDK versions from 1.3.0.Final up to but not including 1.3.2.Final. It involves insufficient protection of credentials due to improper handling of HTTP redirects in the AndroidA2AHttpClient synchronous POST path. This flaw can cause API keys or tokens to be disclosed to unintended authorities when redirects occur, especially if redirect or front-door behavior is compromised or operates across different trust domains. The issue is fixed in version 1.3.2.Final.
CVE-2026-111763 is a vulnerability in the A2A Java SDK prior to version 1.3.0.Final. It allows a malicious or compromised remote agent to cause the default JDK-based client to forward a configured API key to a third-party server via an HTTP header. This occurs because the client uses the remote AgentCard's API key name directly as the header name without verifying the header location, and follows redirects that can forward this credential-bearing header even when standard Authorization headers are stripped. The issue is fixed in version 1.3.0.Final.
Arcane versions prior to 2.5.0 contain a vulnerability where an attacker with certain registry permissions can cause the system to send a stored encrypted container registry token to an attacker-controlled host. This occurs because the registry URL can be changed without supplying a replacement token, leading to exposure of sensitive authentication credentials. The issue is fixed in version 2.5.0.
CVE-2026-104617 is a medium severity vulnerability in SUSE Linux Enterprise Server 16.1 where private data such as $pin and $key are leaked via the /proc filesystem due to insufficient protection in the use of the qrencode utility. This allows low-privileged users to access sensitive credentials. The vulnerability has a CVSS score of 5.1 and does not have a known exploit in the wild. No patch or remediation information is currently provided.
A C++11 single-file header-only cross platform HTTP/HTTPS library. It's extremely easy to setup. Just include httplib.h file in your code!
Security Fix(es):
cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0, create_redirect_client() removes Host, Proxy-Authorization, and Authorization headers when following a cross-origin 301, 302, 307, or 308 redirect but leaves Cookie headers attached. detail::redirect() copies the request for those redirect codes, so cookies supplied directly or through default_headers_ are sent to the redirect target. An attacker who controls a redirect response, or a network position for a non-HTTPS origin, can receive session cookies intended for the original origin. A 303 redirect is not affected because that path clears all request headers. This issue is fixed in version 0.51.0.(CVE-2026-102944)
Mindwtr versions prior to 1.1.5 store sensitive Cloud sync bearer tokens and WebDAV passwords in cleartext within unencrypted AsyncStorage on mobile devices. This allows anyone with access to the application database or device backups to retrieve these credentials and access the user's synchronized tasks and attachments. The issue is resolved in version 1.1.5.