Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5,939 results · page 12 of 119
May 28, 2026Use after free in Passwords in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentiallCVE-2026-10000 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.3
Use after free in Passwords in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
May 28, 2026SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web management interface recoveryCVE-2026-24444 · Other software · SDMC Technology Co., Ltd · reported by VulnCheckCritical 9.3
SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web management interface recovery endpoints (mgmt.php, npcmd.php) that allows unauthenticated attackers to gain root access by submitting the hardcoded credential to the recovery endpoint via HTTP. Attackers can leverage this hardcoded password to enable filtered SSH and Telnet services on the device, resulting in unauthenticated root-level remote access to the underlying system.
- Product
- NE6037
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorden.sdmctech.comkr3bz.wtf
May 28, 2026phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account CVE-2026-35676 · Other software · thorsten · reported by VulnCheckHigh 8.8
phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint that allows attackers to change account passwords without token validation. Attackers can enumerate valid username and email pairs and force immediate password changes by sending PUT requests to the /api/index.php/user/password/update endpoint, causing account disruption and invalidating legitimate user credentials.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
May 28, 2026phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user accCVE-2026-35675 · Other software · thorsten · reported by VulnCheckHigh 8.8
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain plaintext passwords via email, and achieve complete account takeover including administrative access.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
May 28, 2026phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administratorCVE-2026-35671 · Other software · thorsten · reported by VulnCheckHigh 8.7
phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint that allows authenticated administrators to change any user's password without authorization verification. An attacker with low-privilege admin credentials can escalate to SuperAdmin by modifying the userId parameter in the overwrite-password API request.
- Product
- phpMyFAQ
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
May 28, 2026Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it.CVE-2026-4377 · Network & remote access · D-Link Corporation · reported by cvd@cert.plMedium 6
Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords are generated can easily crack the default password if they have the device IMEI number. This issue was fixed in version 1.00B16CP.
- Product
- DWR-X1820
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026IBM Operations Analytics - Log Analysis and IBM SmartCloud Analytics - Log Analysis uses default passwords default passwords from the manufacturing process forCVE-2026-7365 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.4
IBM Operations Analytics - Log Analysis and IBM SmartCloud Analytics - Log Analysis uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication.
- Product
- Operations Analytics - Log Analysis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound auCVE-2026-5065 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.8
IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
- Product
- Controller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequate key management, or flawed code implemCVE-2026-49000 · Other software · ZTE · reported by psirt@zte.com.cnHigh 7
An insecure password scheme refers to vulnerabilities arising from improper selection of encryption algorithms, inadequate key management, or flawed code implementation, which may lead to data leakage or tampering, such as hard-coded keys or the use of weak encryption algorithms.
- Product
- ZXUniPOS NDS-LTE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android allows a local attacker with physical access to bypass the PIN CVE-2025-68711 · Other software · reported by MITRELow 2.4
AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an overlay rather than by using Android's secure authentication APIs. By navigating cascading interface flows - insecure navigation through exposed routes facilitates app control evasion {I.N.T.E.R.F.A.C.E] via advertisement or browser intents, an attacker can evade lockscreen verification and access protected apps (e.g., Chrome). This results in information disclosure and privilege escalation.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Eppendorf BioFlo 320 is vulnerable due to VNC server using a hard-coded password.CVE-2026-7251 · Other software · Eppendorf · reported by ics-cert@hq.dhs.govCritical 9.3
Eppendorf BioFlo 320 is vulnerable due to VNC server using a hard-coded password. If a remote attacker knows the network address of any BioFlo 320 model with remote access enabled, they can gain full control of the user interface by using this password. Once connected, the attacker would have full access to all control panel features for the BioFlo 320. VNC traffic is not encrypted.
- Product
- BioFlo 320
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.CVE-2026-48902 · Websites & servers · Joomla! Project · reported by security@joomla.orgCritical 9.8
The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.
- Product
- Joomla! CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System uses default passwords default passwords from the manufaCVE-2025-36221 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System uses default passwords default passwords from the manufacturing process for use during the installation process, which could allow an attacker to bypass authentication.
- Product
- Cloud Pak for Data System - Cyclops
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2026Missing password field masking vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view, Hitachi Ops Center Analyzer probe modules)CVE-2026-3314 · Other software · Hitachi · reported by hirt@hitachi.co.jpMedium 4.6
Missing password field masking vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view, Hitachi Ops Center Analyzer probe modules), Hitachi Ops Center Analyzer viewpoint, Hitachi Infrastructure Analytics Advisor (Data Center Analytics, Analytics probe modules). This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.8-00; Hitachi Ops Center Analyzer viewpoint: from 10.8.1-00 before 11.0.8-00; Hitachi Infrastructure Analytics Advisor: from 3.2.0-00 before 11.0.8-00.
- Product
- Hitachi Ops Center Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password changeCVE-2026-9249 · Other software · Devolutions · reported by security@devolutions.netLow 3.1
Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
- Product
- Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Dell VxRail versions before 7.0.200 contain a Plain-text Password Storage Vulnerability in VxRail Manager.CVE-2021-21508 · Other software · Dell · reported by security_alert@emc.comMedium 6.7
Dell VxRail versions before 7.0.200 contain a Plain-text Password Storage Vulnerability in VxRail Manager. A sys-admin user may exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
- Product
- VxRail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddellservices.lightning.force.com
May 22, 2026Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords.CVE-2026-8672 · Other software · syslink software AG · reported by vulnerability@ncsc.chMedium 5.1
Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords. This issue affects Avantra: before 25.3.0.
- Product
- Avantra
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords with known values are enCVE-2026-25607 · Other software · Centralny Instytut Ochrony Pracy - Państwowy Instytut Badawczy · reported by cvd@cert.plMedium 5.7
Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords with known values are encoded. This issue was fixed in version 9.5.
- Product
- STER
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2026Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.CVE-2026-8327 · Other software · Concrete CMS · reported by ff5b8ace-8b95-4078-9743-eac1ca5451deMedium 5.3
Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass. The user-profile edit controller passes the entire raw POST array to UserInfo::update() without field whitelisting resulting in password change without requiring the current password and also resulting in registered users able to disable the per-user-IP-pinning in the session validator which is meant to detect hijacking. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks 0x4c616e for reporting.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.org
May 21, 2026In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downlCVE-2026-7879 · Other software · Concrete CMS · reported by ff5b8ace-8b95-4078-9743-eac1ca5451deMedium 6.3
In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading permission-restricted files bypasses the view_file permission check. Files without passwords can be downloaded and any user who knows a file's password can download a password protected file regardless of whether they have permission to access the file. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Youssef Eid for reporting
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.org
May 21, 2026Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php.CVE-2026-48242 · Other software · Open ISES · reported by VulnCheckCritical 9.2
Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php. The credentials are embedded in source code committed to the public repository, allowing any reader of the source to obtain valid configuration values that may match deployed installations.
- Product
- Tickets
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2026Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDCVE-2026-44052 · Other software · Netatalk · reported by 33c584b5-0579-4c06-b2a0-8d8329fcab9cHigh 7.5
Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDAP credentials.
- Product
- Netatalk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026Android App "RoboForm Password Manager" provided by Siber Systems, Inc.CVE-2026-47782 · Other software · Siber Systems, Inc. · reported by vultures@jpcert.or.jpMedium 4.6
Android App "RoboForm Password Manager" provided by Siber Systems, Inc. handles Android intents without sufficient URL validation, user confirmation nor notification. If a URL to some malicious web page is given through an intent, RoboForm may silently download files without user confirmation nor notification.
- Product
- Android App "RoboForm Password Manager"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose password was last set undCVE-2026-0857 · Other software · Mesalvo · reported by a6d3dc9e-0591-4a13-bce7-0f5b31ff6158Medium 4.4
Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose password was last set under a version before MEONA 2024.10. MEONA versions before 2024.10 protected stored passwords with SHA-1 (versions from October 2015) or stored them without protection (earlier versions). Since MEONA 2024.10 (June 2024) Argon2 is the default method and every password that is set or changed is stored with Argon2; passwords last set under an earlier version keep the earlier method until they are changed. An administrator could in addition select the storage method per account. A MEONA super administrator can read the stored value of such accounts in the user administration of the MEONA Client or export it through administrative database functions. Only accounts managed locally in MEONA are affected; accounts authenticated through the operating hospital's directory service (Active Directory / Entra ID) have no password stored in MEONA. In typical installations end users authenticate through the directory service and local accounts are limited to emergency and technical accounts. Exploitation requires super administrator permissio
- Product
- Meona Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkCVE-2026-47784 · Other software · memcached · reported by MITREHigh 8.1
In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.
- Product
- memcached
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2026In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username iCVE-2026-47783 · Other software · memcached · reported by MITREHigh 8.1
In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.
- Product
- memcached
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 2CVE-2026-45434 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
Improper Authentication vulnerability in Apache OFBiz via Password-Change Logic Flaw Leading to Remote Code Execution This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
- Product
- Apache OFBiz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
May 18, 2026An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information via password reset functionality under /CVE-2026-36438 · Other software · reported by MITREMedium 5.3
An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information via password reset functionality under /OutsideCmd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbackend.intelbras.comgithub.com
May 18, 2026Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker tCVE-2026-6345 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 6.5
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 11.4.x <= 11.4.3 fail prevent disclosure of created user password which allows a malicious attacker to impersonate a user via the use of some of those passwords.. Mattermost Advisory ID: MMSA-2026-00614
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2026Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs.CVE-2026-8721 · Other software · JONASBN · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eCritical 9.8
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded. The C code (or OpenSSL internally) calls strlen() on the buffer. Any password byte at or after the first NULL is silently dropped. Binary / KDF-derived / HMAC-derived passwords lose entropy without any warnings.
- Product
- Crypt::OpenSSL::PKCS12
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgopenwall.com
May 15, 2026Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure Permissions, which allows arbitrary user password reset.CVE-2025-67437 · Other software · reported by MITREMedium 6.5
Medical Management System a81df1ce700a9662cb136b27af47f4cbde64156b is vulnerable to Insecure Permissions, which allows arbitrary user password reset.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer procCVE-2026-8547 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 7.5
Insufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
May 14, 2026Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticatCVE-2026-6478 · Other software · Red Hat · reported by f86ef6dc-4d3a-42ad-8f28-e6d5547a5007Medium 6.5
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpostgresql.orgaccess.redhat.com
May 14, 2026Comarch ERP Optima client makes use of a hard-coded password for a database user.CVE-2025-68421 · Other software · Comarch · reported by cvd@cert.plHigh 8.7
Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a remote attacker to gain an access to the database with elevated privileges including executing system commands on a server. This issue has been fixed in version 2026.4
- Product
- ERP Optima
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2026SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection.CVE-2026-46446 · Other software · Alinto · reported by MITREHigh 7.1
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.
- Product
- SOGo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commail-archive.com
May 13, 2026When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext iCVE-2026-28758 · Network & remote access · F5 · reported by f5sirt@f5.comMedium 6.7
When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is also logged in the audit log. This may allow a highly privileged, authenticated attacker with access to the audit log to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2026When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to CVE-2026-6429 · Other software · curl · reported by 2499f714-1537-4658-8207-48ae4bb9eae9Medium 5.3
When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstances.
- Product
- curl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026AntSword is a cross-platform website management toolkit.CVE-2026-43892 · Other software · AntSwordProject · reported by GitHubHigh 8.8
AntSword is a cross-platform website management toolkit. Prior to 2.1.16, incomplete noxss() sanitization leads to 1-click RCE via jquery.terminal format code injection. This vulnerability is fixed in 2.1.16.
- Product
- antSword
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functionCVE-2026-7287 · Network & remote access · Zyxel · reported by security@zyxel.com.twHigh 7.5
** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formUpgradeCert(), and formDelcert() functions of the “webs” binary in Zyxel NWA1100-N customized firmware version 1.00(AACE.1)C0 could allow an attacker to trigger a denial-of-service (DoS) condition by sending a crafted HTTP request to a vulnerable device.
- Product
- NWA1100-N firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an aCVE-2026-43640 · Other software · bitwarden · reported by VulnCheckHigh 8.6
Bitwarden Server prior to v2026.4.1 does not require master-password re-authentication when retrieving or rotating an organization's SCIM API key, allowing an authenticated user with SCIM management privileges to obtain the key using only a valid session.
- Product
- server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote CVE-2026-43826 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-opensearch` 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[opensearch] host` URL.
- Product
- Apache Airflow Providers OpenSearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
May 11, 2026The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wroCVE-2026-41018 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.
- Product
- Apache Airflow Providers Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
May 10, 2026OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/pCVE-2021-47953 · Other software · Opencart · reported by VulnCheckMedium 5.3
OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/password endpoint. Attackers can trick authenticated users into submitting hidden forms with new password values in the 'password' and 'confirm' parameters to hijack accounts.
- Product
- OpenCart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
May 8, 2026Password Pusher is an open source application to communicate sensitive information over the web.CVE-2026-41308 · Other software · pglombardo · reported by GitHubMedium 6.5
Password Pusher is an open source application to communicate sensitive information over the web. Prior to versions 1.69.3 and 2.4.2, a security issue in OSS PasswordPusher allowed unauthenticated creation of file-type pushes through a generic JSON API create path under certain configurations. This could bypass the intended authentication boundary for file push creation. This issue has been patched in versions 1.69.3 and 2.4.2.
- Product
- PasswordPusher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2026A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer.CVE-2024-43384 · Other software · PHOENIX CONTACT · reported by info@cert.vde.comHigh 8
A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer.
- Product
- FL MGUARD 2102
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026Use after free in Passwords in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via a crafted HTML page.CVE-2026-7921 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Passwords in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
May 4, 2026Plaintext storage of a password vulnerability in ILM Informatique OpenConcerto allows Retrieve Embedded Sensitive Data.CVE-2026-6500 · Other software · ILM Informatique · reported by 64c5ae8f-7972-4697-86a0-7ada793ac795Medium 4.8
Plaintext storage of a password vulnerability in ILM Informatique OpenConcerto allows Retrieve Embedded Sensitive Data. This issue affects OpenConcerto: 1.7.5.
- Product
- OpenConcerto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2026phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning.CVE-2026-29199 · Websites & servers · phpBB · reported by support@hackerone.comHigh 8.1
phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When force_server_vars is disabled, the servers hostname may be extracted from the HTTP Host header which is used to generate the password reset link URL. An attacker who can manipulate the Host header (e.g. through misconfigured host setup or missing header validation by the webserver) can cause password reset emails to contain a link pointing to an attacker-controlled domain, potentially leading to account takeover.
- Product
- phpBB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 26, 2026P10 Central Management Software 1.4.13 contains a buffer overflow vulnerability in the login password field that allows local attackers to crash the applicationCVE-2018-25296 · Other software · P10 · reported by VulnCheckMedium 6.8
P10 Central Management Software 1.4.13 contains a buffer overflow vulnerability in the login password field that allows local attackers to crash the application by submitting an oversized input string. Attackers can paste a 2000-byte payload into the password field and click login to trigger an application crash and denial of service.
- Product
- Central Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordambientweather.comexploit-db.com
Apr 23, 2026A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied due to improper handling of credential cCVE-2026-39462 · Other software · SenseLive · reported by ics-cert@hq.dhs.govCritical 9.3
A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied due to improper handling of credential changes on the backend. After the device undergoes a factory restore using the SenseLive Config 2.0 tool, the interface may indicate that the password update was successful; however, the system may continue to accept the previous or default credentials, demonstrating that the password-change process is not consistently enforced. Even after a factory reset, attempted password changes may fail to propagate correctly.
- Product
- X3050
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsenselive.io
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.