A vulnerability in the node-modules urllib HTTP client for Node.js allows sensitive authorization headers and tokens to be sent to attacker-controlled redirected origins due to improper reuse of request options across different origins during redirects. This can expose credentials such as Authorization, Cookie, Proxy-Authorization, and various API tokens without user interaction. The issue affects versions prior to 2.44.1 and 4.9.1 and has a high severity rating.
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoint to return complete monitor objects from server/src/controllers/statusPageController.ts. The response includes the secret field used by HttpProvider.ts as an HTTP Authorization credential, even though BaseStatusPage.tsx does not display that value, allowing visitors to extract credentials from the JSON response and use them against monitored services. This issue is fixed in version 3.9.2.
CloudNativePG versions prior to 1.28.4 and between 1.29.0 and before 1.29.2 stored role passwords in cleartext within SQL statements. This allowed tenants with certain monitoring privileges to extract superuser or application-owner passwords and potentially execute OS commands in the database pod. The vulnerability is fixed in versions 1.28.4, 1.29.2, and 1.30.0.
Kerberos Agent versions prior to 3.6.26 expose sensitive Hub credentials via custom HTTP headers during upload. The agent sends private and public keys in headers that are not stripped on cross-host HTTP redirects, potentially leaking the private key to unintended third parties. This issue is fixed in version 3.6.26 by implementing a redirect policy that strips these sensitive headers on cross-host redirects.
CVE-2026-53586 is a vulnerability in libgit2's built-in HTTP transport prior to versions 1.8.6 and 1.9.5. The issue involves improper handling of HTTP redirects and credential callbacks, causing sensitive HTTP Basic credentials or personal access tokens to be exposed to unauthorized actors if an attacker controls a trusted Git host or an open redirect. This vulnerability is fixed in libgit2 versions 1.8.6 and 1.9.5.
CVE-2026-8810 is a vulnerability in Insyde Software's InsydeH2O firmware for ARM platforms. It involves insufficient protection of HDD Password credentials stored in UEFI variables, potentially allowing an attacker to retrieve these passwords. The vulnerability has a CVSS score of 6.9, indicating a medium severity level. No specific affected versions or patches have been provided. There are no known exploits in the wild at this time.
CVE-2026-53456 is a medium severity vulnerability in ha-china's blueprint-studio prior to version 2.5.2. The issue involves insufficient protection of SSH private key credentials used for terminal authentication. The private key was written to a file in the Home Assistant configuration directory with a best-effort cleanup approach, which could fail or be interrupted, leaving the key accessible on disk. This residual key could be accessed by any user or process with filesystem access to the configuration directory. The vulnerability is fixed in version 2.5.2.
Blueprint Studio, a VS Code-like editor for Home Assistant configuration files, prior to version 2.5.2, stored Git credentials in plaintext in the .git-credentials file due to configuring Git's credential.helper store. This caused usernames and access tokens to be persistently saved outside the intended secure storage, making them accessible to other users or processes with filesystem access. The issue was fixed in version 2.5.2.
CVE-2026-15806 is a vulnerability in the Python CPython urllib.request module where HTTPPasswordMgr classes did not consider the URL scheme when matching stored credentials. This caused credentials registered for HTTPS URLs to be sent over HTTP requests to the same host, exposing them to interception if an attacker could redirect or downgrade connections to plain HTTP. The issue is fixed by scoping credential matching to the URL scheme. Users unable to upgrade immediately should avoid making plain HTTP requests to hosts with stored credentials.
CVE-2026-57485 is a high-severity vulnerability in Stirling-Tools Stirling-PDF prior to version 2.9.0. It involves exposure of a sensitive API key (STIRLING-PDF-BACKEND-API-USER) to authenticated users with ROLE_USER privileges via the /api/v1/user/get-api-key endpoint. This key allows impersonation of an internal service account, bypassing rate limits and accessing internal endpoints. The issue is fixed in version 2.9.0.
CVE-2026-14564 is a critical vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co.'s Logsign SIEM product. It involves insufficient protection of embedded credentials, allowing unauthorized retrieval of sensitive data. The issue affects versions from 6.4.97 up to but not including 6.4.114. A fix is available in version 6.4.114.
An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a local attacker to view sensitive data.
A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a user to bypass intended security controls.
A flaw was found in multicluster-global-hub. During a ManagedClusterMigration, the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised managed hub to intercept and collect sensitive bootstrap kubeconfigs, which contain API server tokens intended for other hubs. These tokens have an extended validity of approximately 9.86 years, significantly increasing the risk of unauthorized access and information disclosure to other managed clusters.
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on attacker-chosen resource families because those entrypoints do not consistently enforce the documented per-resource `read` and `write` authorities. The documented authorization model requires an operation authority (e.g. `pathling:search`) to be paired with the matching per-resource `read` or `write` authority (e.g. `pathling:read:Patient`). Delete and batch are documented to require write authority for all referenced resource types. However, typed search, update, and related handlers are annotated only with `@OperationAccess(...)` and act on the provider-selected resource type without checking the corresponding per-resource authority. This is fixed in Pathling Server 2.0.0.
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit `oauthMetadataUrl` parameter that is not validated against `pathling.bulkSubmit.allowableSources`. When present, the bulk-submit OAuth flow trusts metadata and the returned `token_endpoint` from the caller-chosen location, then builds outbound OAuth client authentication directly from the submitter's stored credentials. This is fixed in Pathling Server 2.0.0.