CVE-2026-42951 is a medium severity vulnerability in the Danelec MacGregor Voyage Data Recorder (VDR) G4e. An authenticated user with low privileges can download a backup of the device, which contains account data and password hashes. This exposure could lead to unauthorized access if the password hashes are cracked. There is no official patch or remediation level provided at this time. The vulnerability requires authentication and high attack complexity, limiting immediate exploitation. No known exploits are reported in the wild.
Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, expose Hadoop cluster credentials in plain text through the Cluster Test API. Although the user should not see those explicitly, the defect is mitigated by the fact the user can already leverage those credentials to submit jobs under the same account through the backend API.
TypeBot is a chatbot builder tool. In versions 3.15.2 and prior, the fix for GHSA-4xc5-wfwc-jw47 ("Credential Theft via Client-Side Script Execution and API Authorization Bypass") is incomplete. While the builder's getCredentials tRPC endpoint was patched with workspace membership checks, the bot-engine runtime still allows any authenticated user to use credentials from any workspace via the preview chat endpoint. The bot-engine's getCredentials() utility function uses a falsy check (if (workspaceId && ...)) for workspace ownership validation. Since the preview endpoint accepts a client-controlled workspaceId field and the Zod schema allows empty strings, an attacker can supply workspaceId: "" to bypass credential ownership verification entirely. Exploitation can result in credential exfiltration, external service abuse, financial damage and a data breach.
Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc. WifiBurada allows Authentication Bypass.
This issue affects WifiBurada: through 21052026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
The affected product may expose credentials remotely between low privileged visualization users during concurrent login operations due to insufficient isolation of authentication data. The vulnerability affects only login operations within an active visualization session.
HCL AION is affected by a vulnerability where basic authorization tokens are used for authentication. Use of basic authorization mechanisms may expose credentials to potential interception or misuse, especially if not combined with secure transmission practices.
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call parameter. The BIP-39 seed was consequently embedded in the LLM tool-call JSON, exposing it to any transport, log, or telemetry surface in the path between the LLM provider and the MCP process. This vulnerability is fixed in 0.x.y-security-1.
CVE-2026-8368 is a vulnerability in OALDERS LWP::UserAgent versions before 6.83 for Perl where Authorization and Proxy-Authorization headers are leaked during cross-origin redirects. The redirect handler fails to strip these sensitive headers on 3xx responses, sending them unchanged to the redirect target, which can be an attacker-controlled host. This results in disclosure of the caller's credentials. The vulnerability has a medium severity with a CVSS score of 6.5. No patch or official remediation has been confirmed yet.
sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterprise mode, versions 0.1.0-alpha.1 through 0.1.0-alpha.3 embedded the operator's literal TOTP secret in the JWS payload of every minted unseal token. JWS payload is base64-encoded JSON, NOT encrypted. Any party who could observe a minted token (CI build logs, container env dumps, kubectl describe pod, Sentry/Rollbar stack traces, log aggregators) could decode the payload and extract the TOTP secret in plaintext. This vulnerability is fixed in 0.1.0-alpha.4.
CVE-2026-42869 is a critical improper authentication vulnerability in SOCFortress CoPilot versions prior to 0.1.57. The product shipped with a hardcoded JWT signing secret used as a fallback if the JWT_SECRET environment variable was not set. This secret was publicly known and included in example configuration files. An unauthenticated attacker could exploit this to forge admin-level JWT tokens, gaining full control over the application and all managed security tools. The vulnerability has a CVSS score of 10.0 and is fixed in version 0.1.57.
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc.) in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials. This issue has been patched in version 4.0.5.
go-git versions prior to 5.18.0 and 6.0.0-alpha.2 contain a vulnerability where HTTP authentication credentials may be leaked when following redirects during smart-HTTP clone and fetch operations. This issue has been addressed in versions 5.18.0 and 6.0.0-alpha.2.
HCL BigFix RunBookAI is affected by a Continued availability of Less-Secure “Input Text” Vulnerability . A component contains a security weakness in its input handling implementation, increasing the risk of misconfiguration and operational errors.
CVE-2026-23927 is a vulnerability in Zabbix Agent 2 where a user with connection access can inject an Oracle TNS connection string via the 'service' parameter. This injection can cause the agent to connect to an attacker-controlled server, potentially leaking Oracle database credentials if stored in a named session. The vulnerability affects specific Zabbix versions 6.0.0, 7.0.0, and 7.4.0 and has a medium severity rating with a CVSS 4.0 score of 5.1.
A privilege escalation vulnerability exists in the Web Interface / ssi.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to credentials leak. An attacker can visit a webpage to trigger this vulnerability.
The My Social Feeds – Social Feeds Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.0.4 via the 'ttp_get_accounts' AJAX action. This is due to the complete absence of authorization checks (no capability verification) and nonce verification in the get_accounts() function, which returns the full contents of the 'ttp_tiktok_accounts' WordPress option. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive TikTok OAuth credentials, including access_token and refresh_token values, that belong to administrator-connected TikTok accounts, enabling them to impersonate the site owner when interacting with the TikTok API.
Dell iDRAC10 versions 1.20.70.50 and 1.30.05.10 have an Insufficiently Protected Credentials vulnerability due to a race condition. This flaw allows an authenticated low-privileged attacker to potentially gain elevated access. The vulnerability is tracked as CVE-2026-35155 and has a CVSS score of 7.1, indicating high severity.
CVE-2026-7038 is a medium severity vulnerability in tufantunc ssh-mcp versions up to 1.5.0. It involves insufficiently protected credentials in an unknown function within the src/index.ts file of the Command Line Handler component. The vulnerability requires local access to exploit and does not require user interaction. Although a public exploit is available, there is no vendor response or patch at this time.
CVE-2026-39462 is a critical vulnerability in the SenseLive X3050 device's web management interface where password updates are not reliably applied. After a factory reset using the SenseLive Config 2.0 tool, the interface may falsely indicate a successful password change, but the system may continue to accept previous or default credentials. This indicates that the password-change process is not consistently enforced, potentially allowing unauthorized access even after a reset.
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive data including API keys, HTTP authorization headers and internal configuration without any authentication. An attacker with knowledge just of a chatflow UUID can retrieve credentials stored in password type fields and HTTP headers, leading to credential theft and more. This vulnerability is fixed in 3.1.0.