Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,841

Export CSV
CVE-2026-86375

Missing Encryption of Sensitive Data in Dell Application Installer

Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Application Installer
CVE-2026-8596

Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path

Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow a remote authenticated actor to extract the HMAC signing key from SageMaker API responses and forge valid integrity signatures for specially crafted model artifacts, achieving code execution in inference containers. This issue requires a remote authenticated actor with permissions to call SageMaker describe APIs and S3 write access to the model artifact path. To remediate this issue, we recommend upgrading to Amazon SageMaker Python SDK v2.257.2 or v3.8.0 and rebuild any models previously created with ModelBuilder using the updated SDK.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Amazon Aws
Products
Sagemaker Python Sdk Amazon Sagemaker Python Sdk
CVE-2026-107807

Nginx UI: Node Secret Credential Exposure via URL Query Parameter

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret header. The credential can consequently appear in access logs, proxy logs, browser history, Referer headers, configuration URLs, and deployment environment data. A party that obtains the secret can bypass normal password, JWT, session, and second-factor checks and obtain persistent administrative API access, including access to configuration and secret material. This issue is fixed in version 2.5.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
0xjacky Nginxui
Products
Nginx-ui Nginx Ui
CVE-2026-108120

path traversal inKoozali - SME Server

Brian Mariani from DigitalCanion SA has discovered a path traversal vulnerability in the View Logs functionality of koozali's SME Server version 11.0rc1-215 allowing an unauthenticated attacker to access files outside of the intended directory, leading to exfiltration of files located outside the intended system logs directory, including potentially sensitive system and application files.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Koozali
Products
Sme Server
CVE-2026-67221

RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Rabbitmq
Products
Rabbitmq Server Rabbitmq-server
CVE-2026-111993

Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage

A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Impacted is the function UserDao.login of the file code/src/service/AdminDao.java. This manipulation of the argument Password causes cleartext storage of sensitive information. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Soarkey
Products
Studentmanagement
CVE-2026-66782

Submariner-operator: operator clusterrole grants cluster-wide create/update on all configmaps

A flaw was found in the Submariner operator. This vulnerability allows for the exposure of a long-lived broker service account (SA) bearer token within the Submariner Custom Resource (CR) specification. An attacker with access to the cluster's etcd database or through `kubectl get` commands could obtain this token. The possession of this token grants full control over the mesh network, enabling unauthorized management of network resources such as endpoints and secrets.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Advanced Cluster Management For Kubernetes
CVE-2026-66781

Submariner-operator: pprof debug endpoint enabled by default on 0.0.0.0:8082 without authentication

A flaw was found in the Submariner operator. The Submariner Custom Resource (CR), used for configuring network connectivity, stores the IPsec pre-shared key (PSK) in an unencrypted format. This key, which is critical for securing communication between Kubernetes clusters, can be accessed by unauthorized parties. Such access enables an attacker to passively decrypt network traffic flowing between any two clusters in the mesh, resulting in sensitive information disclosure.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Advanced Cluster Management For Kubernetes
CVE-2026-77151

lin-snow Ech0 crypto.go MD5Encrypt risky encryption

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 5.4.2 can resolve this issue. The patch is named 9ce19a3b0d0765086a655f45d3a706ec1810404f. It is recommended to upgrade the affected component.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Lin-snow
Products
Ech0
CVE-2026-108728

Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook

Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environment variables. The embedded secret manager webhook writes base64-encoded FILE-mounted secret values into the SECRETS environment variable, letting principals without Secret store access decode them from the Pod spec.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Flyteorg
Products
Flyte
CVE-2026-67236

RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an auth cookie containing base64-encoded username:password credentials without HttpOnly, Secure, SameSite, or expiration protections. Because base64 is encoding rather than encryption, an attacker with same-origin cross-site scripting, an HTTP-readable network position, or local access to the browser cookie store could recover the actual login credentials; older browsers that treated an absent SameSite attribute as None also sent the cookie cross-site. This issue is fixed in versions 4.2.8 and 4.3.2.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Broadcom Rabbitmq Redhat
Products
Rabbitmq Server Rabbitmq-server Hummingbird
CVE-2026-85975

Cleartext transmission in Progress MarkLogic Server Amazon S3 connections

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A network-positioned attacker could intercept data or credentials transmitted through an affected connection.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Progress Software Corporation
Products
Marklogic Server
CVE-2026-19864

org.eclipse.jetty/jetty-security: Eclipse Jetty: Plaintext password disclosure via session persistence

Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-102539

Super Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is set

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls sync(true) before a user sets an encryption password, causing the operation-upload path to transmit and store all user operations in plaintext. The exposed operations can include private task content and connected issue-provider credentials, including reusable passwords, API tokens, and app passwords. Users who complete E2EE setup have the plaintext operations deleted, while users who leave the password-setting step can leave the data stored indefinitely. The Disable SuperSync action did not remove plaintext that had already been uploaded. Routing and causal metadata remain plaintext by design and are not part of this vulnerability. This issue is fixed in version 18.13.1.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Super-productivity
Products
Super-productivity
CVE-2023-23915

curl: HSTS amnesia with --parallel

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers are done in parallel as the HSTS cache file gets overwritten by the most recentlycompleted transfer. A later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Haxx Netapp Redhat and 1 more
Products
Curl Active Iq Unified Manager Clustered Data Ontap and 10 more
CVE-2023-23914

curl: HSTS ignored on multiple requests

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be instructed to use HTTPS instead of usingan insecure clear-text HTTP step even when HTTP is provided in the URL. ThisHSTS mechanism would however surprisingly be ignored by subsequent transferswhen done on the same command line because the state would not be properlycarried on.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Haxx Netapp Redhat and 1 more
Products
Curl Active Iq Unified Manager Clustered Data Ontap and 10 more
CVE-2015-0204

openssl: only allow ephemeral RSA keys in export ciphersuites (FREAK)

The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct RSA-to-EXPORT_RSA downgrade attacks and facilitate brute-force decryption by offering a weak ephemeral RSA key in a noncompliant role, related to the "FREAK" issue. NOTE: the scope of this CVE is only client code based on OpenSSL, not EXPORT_RSA issues associated with servers or other TLS implementations.

CVSS 3.0 · 5.3 Medium EPSS 98.7% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Jboss Enterprise Application Platform and 1 more
CVE-2022-43551

curl: HSTS bypass via IDN

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypassed if the host name in the given URL first uses IDN characters that get replaced to ASCII counterparts as part of the IDN conversion. Like using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop (U+002E) `.`. Then in a subsequent request, it does not detect the HSTS state and makes a clear text transfer. Because it would store the info IDN encoded but look for it IDN decoded.

CVSS 3.1 · 7.5 High EPSS 16.6% KEV · Not listed
Vendors
Fedoraproject Haxx Netapp and 2 more
Products
Fedora Curl Active Iq Unified Manager and 5 more
CVE-2022-42916

curl: HSTS bypass via IDN

In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using an insecure cleartext HTTP step) even when HTTP is provided in the URL. This mechanism could be bypassed if the host name in the given URL uses IDN characters that get replaced with ASCII counterparts as part of the IDN conversion, e.g., using the character UTF-8 U+3002 (IDEOGRAPHIC FULL STOP) instead of the common ASCII full stop of U+002E (.). The earliest affected version is 7.77.0 2021-05-26.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Apple Fedoraproject Haxx and 2 more
Products
Macos Fedora Curl and 2 more
CVE-2026-5769

Cleartext Fabric OS Admin Passwords Trapped in Memory Swap File in Brocade SANnav

A vulnerability in Brocade SANnav before 3.0.1 can have the Brocade Fabric OS switch admin password captured in plaintext within a memory swap file on the server hosting the Brocade SANnav Virtual Machine (VM). This can happen when the SANnav server encounters an Out Of Memory (OOM) condition. The vulnerability could allow an authenticated admin user with access to the server hosting the SANnav to potentially view the memory swap file and access the password(s).

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom
Products
Brocade Sannav