Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,841

Export CSV
CVE-2026-114614

Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout registration, authorization-server metadata validation, or another call site can bypass the TLS-required guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable authlib.common.security.is_secure_transport() implementation in authlib/common/security.py misinterprets the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers enforce transport security. This issue is fixed in version 1.8.0.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed
Vendors
Authlib
Products
Authlib
CVE-2026-115400

crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens

crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users' Google Search Console data.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Crawlseo
Products
Crawlseo
CVE-2026-116844

Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P

Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag set by PROT, not whether the prepared data connection uses TLS. When a client sends PROT P after PASV or PORT, file contents and directory listings cross the network unencrypted, even with mandatory encryption, letting on-path attackers read or modify them.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Fclairamb
Products
Ftpserverlib
CVE-2026-94346

Path Traversal Leading to Remote Command Execution in Dell PowerProtect Data Domain Virtual Edition

PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Path Traversal vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Powerprotect Data Domain Virtual Edition
CVE-2026-100635

SiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie

SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attributes over plaintext HTTP connections. An on-path attacker can observe a valid publish-visitor-session-id cookie from a Basic Auth exchange and replay it to access authenticated publish endpoints without knowing the account password.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-107692

War Thunder Account Impersonation

The War Thunder game client transmits its authentication bearer token (auth_jwt) in the very first data packet after the TCP handshake, using only LZ4 compression rather than encryption. An attacker positioned on the network path can passively intercept and decompress this packet to reveal the plaintext JSON payload. This vulnerability allows for temporary authenticated impersonation, enabling an attacker to access game services and certain user data (such as email address and displayed phone number) as the affected user. While this allows for unauthorized access to gameplay, it does not facilitate full account takeover, as it cannot be used to modify account security settings, change passwords, bypass two-factor authentication for account management, or access financial information.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gaijin Entertainment
Products
War Thunder
CVE-2026-77054

Cleartext Storage of Sensitive Information in boneIO

boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the endpoint and access the administrative passwords in cleartext form. Critically, due to CVE-2026-77053 (authentication disabled by default), an unauthenticated attacker on the same local network can retrieve all passwords. This issue was fixed in version 1.6.0: web panel passwords are stored as salted scrypt hashes in a file readable only by the service account, and the API and logs no longer return secret values. The MQTT broker password has to stay recoverable because the application presents it to the broker as a client; it is kept in a separate file readable only by the service account and is no longer exposed through the API.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Boneio
Products
Boneio
CVE-2026-116114

Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission

A weakness has been identified in Yoosee GM8135S Camera 21.00.01.36. This affects an unknown function of the file /npc/npc of the component Live UDP H.264 Video Stream Handler. This manipulation causes cleartext transmission of sensitive information. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yoosee
Products
Gm8135s Camera
CVE-2026-116105

HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission

A weakness has been identified in HeyCyan App 1.0.103 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component Network Security Configuration. Executing a manipulation can lead to cleartext transmission of sensitive information. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Heycyan App
Products
Heycyan App
CVE-2026-16802

Cleartext Storage of Secret Variables in Devolutions PowerShell Universal

Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Devolutions
Products
Powershell Universal
CVE-2026-76376

Information Disclosure through Action Parameters in AWS IAM app for Splunk SOAR

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameter as a password. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises).

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Splunk
Products
Aws Iam App For Splunk Soar
CVE-2026-15102

Cleartext Transmission of Sensitive Information in ADP Desktop SDK

ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Autodesk
Products
Adp Desktop Sdk
CVE-2026-115247

subhajitkhan online-clinic-management-system patientregistration.php missing encryption

A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This vulnerability affects unknown code of the file patientregistration.php. The manipulation of the argument pat_pswd/doc_pswd leads to missing encryption of sensitive data. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Subhajitkhan
Products
Online-clinic-management-system
CVE-2026-114576

Linksys RE6250 Web Management strcmp random values

A vulnerability has been found in Linksys RE6250 1.0.04.001. This affects the function strcmp of the component Web Management Interface. The manipulation of the argument session_id leads to insufficiently random values. The attack may be initiated remotely. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Linksys
Products
Re6250 Re6250 Firmware
CVE-2026-111063

AIOHTTP: Secure attribute not enforced for shared cookie

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Aio-libs
Products
Aiohttp
CVE-2026-43854

Credential Disclosure via Encrypted Project File on Advantech ADAM‑3600

A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Advantech
Products
Adam-3600
CVE-2026-96293

Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File

A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Watchguard Agent
CVE-2026-21812

Multiple security vulnerabilities affect HCL AppScan Azure Boards Plugin (CVE-2026-12143 and CVE-2026-13149)

HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authentication tokens during transmission. The plugin has been updated to display a warning when HTTP is used and recommend HTTPS for secure communication.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Appscan Integration With Azure Boards For Asoc & A360
CVE-2026-53986

Girafit Camera App 1.9.1 Hardcoded TURN Credentials Disclosure

Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcoded credentials vulnerability that allows attackers to obtain the shared TURN relay username by decompiling the app or intercepting unencrypted network traffic during live view registration. Attackers can extract the static TURN username and session token, which are identical across all installs and not tied to any user or device, potentially enabling tracking, impersonation, or further exploitation if combined with the TURN relay password.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Girafit
Products
Girafit Camera App