Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 246

Export CSV
CVE-2026-42151

Prometheus Azure AD remote write OAuth client secret exposed via config API

Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Prometheus
Products
Prometheus
CVE-2026-19051

Plaintext Storage of User Credentials in Menulux Software's Menulux Portal

Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Menulux
Products
Menulux Portal
CVE-2026-15933

Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)

OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user list import), and SharePoint credentials, in cleartext via the web administration panel page source, allowing exposure of sensitive third-party authentication data. This issue was fixed in version 26.08

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Optimidoc
Products
Optimidoc Server
CVE-2026-82453

rust-iot-platform Cleartext Password Storage via User Model

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Iot-ecology
Products
Rust-iot-platform
CVE-2026-55765

CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements was preloaded with track_utility enabled and an untrusted tenant held pg_monitor or pg_read_all_stats, the tenant could recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute operating system commands in the database pod with `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Cloudnative-pg
Products
Cloudnative-pg
CVE-2026-21660

Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware

A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick Controls Quantum HD version 10.22 and prior.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Johnsoncontrols
Products
Frick Controls Quantum Hd Frick Controls Quantum Hd Firmware
CVE-2026-55164

Lemur: Plaintext password storage in Lemur user-update path

Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hash_password only for the before_insert event. Because no before_update listener ran, administrator-initiated password changes through PUT /api/1/users/ were committed as plaintext. The affected user could no longer authenticate normally because bcrypt verification received an unhashed value. A database, backup, replica, query-log, or administrative read compromise exposed immediately usable credentials without offline cracking. The fix registers hashing for before_update and avoids rehashing values that already have a bcrypt prefix. This issue is fixed in version 1.9.2.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Netflix
Products
Lemur
CVE-2026-31850

Plaintext Storage of Credentials in Configuration Backup in Nexxt Nebula 300+

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 stores sensitive information, including administrative credentials and WiFi pre-shared keys, in plaintext within exported configuration backup files. These backup files can be obtained through legitimate functionality or other weaknesses and do not apply encryption or hashing, allowing attackers to directly extract sensitive information.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Nexxtsolutions
Products
Nebula300+ Nebula300plus Nebula300plus Firmware
CVE-2026-50641

Plaintext password storage in Streamsoft Business Intelligence

Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Streamsoft
Products
Business Intelligence
CVE-2026-41874

Hard-coded admin credentials in Quick.Cart

Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary. Only version 6.7 was tested but all versions should be considered as vulnerable.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Opensolution
Products
Quick.cart
CVE-2020-37115

GUnet OpenEclass 1.7.3 E-learning platform - Plaintext Password Storage

GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords without encryption. This vulnerability exposes sensitive information and increases the risk of credential theft and unauthorized access.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gunet Openeclass
Products
Open Eclass Platform Openeclass
CVE-2018-25396

Heatmiser Wifi Thermostat 1.7 Credential Disclosure via networkSetup.htm

Heatmiser Wifi Thermostat 1.7 contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve administrative credentials by accessing the networkSetup.htm page. Attackers can request the networkSetup.htm endpoint and extract plaintext username and password values from HTML form fields to gain administrative access to the thermostat.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Heatmiser Redhat
Products
Heatmiser Wifi Thermostat Thermostat
CVE-2026-40430

Plaintext Storage of a Password in Panduit IntraVUE by Pronetiqs

Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Pronetiqs
Products
Panduit Intravue
CVE-2026-42295

Argo Workflows: Exposure of artifact repository credentials

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials (S3 access keys, secret keys, GCS service account keys, Azure account keys, Git passwords, etc.) in plaintext on artifact operation. Any user with read access to workflow pod logs can extract these credentials. This issue has been patched in version 4.0.5.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Argoproj
Products
Argo-workflows Argo Workflows
CVE-2026-46513

Frogman: API tokens stored in plaintext

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hex(random_bytes(32)) strings in oc_api_tokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stored raw value, allowing database read access to recover reusable active tokens at their assigned permission level, including admin. This issue is fixed in version 1.6.2.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Mwtcmi
Products
Frogman
CVE-2026-44187

Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text within the user's configuration file and writes it to output log files. This information disclosure can lead to the attacker obtaining the API credential and potentially consuming the user's API quota.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform
CVE-2026-14867

Insecure password storage in User directory

Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials.  Active Directory accounts are not affected by this vulnerability.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Arcinfo
Products
Pcvue
CVE-2026-57302

Jenkins FitNesse Plugin Exposes Unencrypted Passwords in Config Files

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jenkins Jenkins Project
Products
Fitnesse Jenkins Fitnesse Plugin