Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,272 results · page 14 of 66
May 12, 2026CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could resCVE-2026-34667 · Other software · Adobe · reported by AdobeMedium 6.2
CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials JS SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an appCVE-2026-34666 · Other software · Adobe · reported by AdobeMedium 6.2
CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials JS SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to CVE-2026-34665 · Other software · Adobe · reported by AdobeHigh 7.5
CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction.
- Product
- Content Credentials JS SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentiCVE-2026-8109 · Network & remote access · ivanti · reported by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75Medium 6.5
An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attacker to leak access credentials.
- Product
- Endpoint Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board.CVE-2026-8072 · Other software · Ingeteam · reported by cve-coordination@incibe.esCritical 9.2
Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a privilege escalation.
- Product
- Ingecon Sun EMS Board
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordincibe.esreversemode.com
May 11, 2026Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.CVE-2026-45362 · Other software · Sangoma · reported by MITRELow 3.2
Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.
- Product
- Switchvox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys.CVE-2026-6146 · Other software · BIGFOOT · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.3
Amazon::Credentials versions through 1.2.0 for Perl uses rand to generate encryption keys. Amazon::Credentials stores credentials in an obfuscated form to prevent access to the secrets from a data dump of the object. Before version 1.3.0, the secrets were encrypted using a 64-bit key that was generated using the built-in rand function, which is predictable and unsuitable for cryptography.
- Product
- Amazon::Credentials
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgmetacpan.org
May 11, 2026Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability.CVE-2026-40636 · Other software · Dell · reported by security_alert@emc.comCritical 9.8
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for attacker.
- Product
- ECS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote CVE-2026-43826 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-opensearch` 1.9.1 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[opensearch] host` URL.
- Product
- Apache Airflow Providers OpenSearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
May 11, 2026The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wroCVE-2026-41018 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users are advised to upgrade to `apache-airflow-providers-elasticsearch` 6.5.3 or later and, as a defense-in-depth measure, configure the backend credentials via a secret backend rather than embedding them in the `[elasticsearch] host` URL.
- Product
- Apache Airflow Providers Elasticsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.apache.org
May 8, 2026Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication.CVE-2026-8076 · Other software · CashDro · reported by cve-coordination@incibe.esCritical 9.3
Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication. The system supports the use of PIN-based credentials, maintaining compatibility with POS software integrations deployed since 2012. This could allow an attacker to easily perform a brute-force attack against a user and gain access by trying different PINs without the account being locked. Successful exploitation of this vulnerability could result in unauthorized access to confidential configuration settings, compromising the security of the system.
- Product
- CashDro 3 Administration Panel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlabs.itresit.esincibe.es
May 7, 2026A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft.CVE-2026-8106 · Other software · GitHub · reported by product-cna@github.comMedium 5.9
A reflected HTML injection vulnerability was identified in the GitHub Enterprise Server Management Console login page that could allow credential theft. The redirect_to query parameter on the /setup/unlock endpoint was reflected into an HTML attribute without proper sanitization, enabling an attacker to inject a form element that could capture administrator credentials. Exploitation required an administrator to click a crafted link and enter their credentials. This vulnerability affected GitHub Enterprise Server versions 3.19.1 through 3.19.5 and 3.20.0 through 3.20.1, and was fixed in versions 3.19.6 and 3.20.2. This vulnerability was reported via the GitHub Bug Bounty program.
- Product
- Enterprise Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.github.comdocs.github.com
May 7, 2026Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image.CVE-2026-7414 · Other software · Yarbo · reported by cve@takeonme.orgCritical 9.8
Yarbo firmware v2.3.9 contains hardcoded administrative credentials embedded in the firmware image. These credentials are identical across all devices running this firmware and cannot be changed or removed by end users, enabling trivial unauthorized access to device management interfaces by anyone who knows them.
- Product
- Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtakeonme.org
May 7, 2026Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format.CVE-2025-4397 · Other software · Medtronic · reported by security@medtronic.comMedium 6.8
Medtronic MyCareLink Patient Monitor uses per-product credentials that are stored in a recoverable format. An attacker can use these credentials to modify encrypted drive data.
- Product
- MyCareLink Patient Monitor 24950
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackeCVE-2026-41930 · Websites & servers · reported by VulnCheckCritical 9.2
Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials. Attackers can connect to the phpMyAdmin port to gain unrestricted read and write access to the entire Vvveb database, including administrator password hashes, customer personally identifiable information, and order data, enabling account takeover and data manipulation.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2026Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6.CVE-2026-34474 · Other software · reported by MITREHigh 7.5
Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6. A crafted request to the router web interface can expose sensitive device and account information. In affected builds, the response may include the administrator password and WLAN PSK, enabling authentication bypass and network compromise. Some firmware versions may expose only partial identifiers (e.g., serial number, ESSID, MAC addresses).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comzte.com.cn
May 6, 2026HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal appliCVE-2025-31976 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.8
HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal application which could allow an attacker to potentially misuse them, if exfiltrated. .
- Product
- BigFix Service Management (SM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
May 4, 2026In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can CVE-2026-42811 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.4
In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause those credentials to work across the configured bucket instead. Apache Polaris builds Google Cloud Storage downscoped credentials by creating a Credential Access Boundary (CAB) with CEL conditions that are intended to restrict access to the requested table's storage path. The relevant CEL string is built from the bucket name and the table path. That table path is derived from namespace and table identifiers. In current code, that path appears to be inserted into the CEL expression without escaping. As a result, a namespace or table identifier containing a single quote and other URI-safe CEL fragments can break out of the intended quoted string and change the meaning of the CEL condition. In private testing against Polaris 1.4.0 on real Google Cloud Storage, it was confirmed that Polaris accepted a crafted identifier and returned delegated GCS credentials whose CEL path restriction had effectively collapsed. Those delegated credentials could then: - list another table's object prefix; - read another tabl
- Product
- Apache Polaris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
May 4, 2026Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or dCVE-2026-42809 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.4
Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or durably reserved. Those temporary credentials are meant to limit the scope of accessible table data and metadata, but this scope limitation becomes attacker- directed because the attacker can choose a reachable target location. In the confirmed variant, if the caller supplies a custom `location` during stage create and requests credential vending, Apache Polaris uses that location to construct delegated storage credentials immediately. The stage-create path itself neither runs the normal location validation nor the overlap checks before those credentials are issued. Closely related to that, the staged-create flow also accepts `write.data.path` / `write.metadata.path` in the request properties and feeds those location overrides into the same effective table location set used for credential vending. Those fields are secondary to the main custom-`location` exploit, but they are still attacker-influenced location inputs that should be validated before any credentials are issued.
- Product
- Apache Polaris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Apr 30, 2026Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext.CVE-2026-28909 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
Users who connect to malicious registries with hostnames matching the bypass patterns will have their registry credentials exposed in plaintext. This issue is fixed in container version 0.12.3.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 30, 2026IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.3.0, 5.3.1 stores user credentials in plain text which can be read by a local user.CVE-2025-36335 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.2
IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.3.0, 5.3.1 stores user credentials in plain text which can be read by a local user.
- Product
- watsonx.data intelligence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers with valid credentials to discloseCVE-2018-25311 · Other software · VideoFlow Ltd. · reported by VulnCheckHigh 7.1
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers with valid credentials to disclose arbitrary files by injecting path traversal sequences in the ID parameter. Attackers can submit requests to downloadsys.pl, download_xml.pl, download.pl, downloadmib.pl, or downloadFile.pl with directory traversal payloads to read sensitive system files like /etc/passwd.
- Product
- VideoFlow Digital Video Protection
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Apr 29, 2026Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to proCVE-2026-42520 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 7.5
Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide credentials to a job to write files to arbitrary locations on the node filesystem, which can lead to remote code execution if Jenkins is configured to allow a low-privileged user to configure file or zip file credentials used for a job running on the built-in node.
- Product
- Jenkins Credentials Binding Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2026Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability.CVE-2026-35155 · Other software · Dell · reported by security_alert@emc.comHigh 7.1
Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains an Insufficiently Protected Credentials vulnerability. A race condition vulnerability exists that could allow an authenticated low‑privileged attacker to gain elevated access.
- Product
- iDRAC10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2026An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials aCVE-2026-3323 · Other software · VEGA Grieshaber · reported by info@cert.vde.comHigh 7.5
An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.
- Product
- VEGAPULS 6X Two-wire PROFINET, Modbus TCP, OPC UA (Ethernet-APL)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcertvde.comvega.csaf-tp.certvde.com
Apr 28, 2026In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials,CVE-2026-40966 · Other software · VMware · reported by security@vmware.comMedium 5.9
In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected.
- Product
- Spring AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 27, 2026Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials.CVE-2026-27785 · Other software · Milesight · reported by ics-cert@hq.dhs.govHigh 7.7
Specific firmware versions of Milesight AIOT camera firmware contain hard-coded credentials.
- Product
- MS-Cxx63-PD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied due to improper handling of credential cCVE-2026-39462 · Other software · SenseLive · reported by ics-cert@hq.dhs.govCritical 9.3
A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied due to improper handling of credential changes on the backend. After the device undergoes a factory restore using the SenseLive Config 2.0 tool, the interface may indicate that the password update was successful; however, the system may continue to accept the previous or default credentials, demonstrating that the password-change process is not consistently enforced. Even after a factory reset, attempted password changes may fail to propagate correctly.
- Product
- X3050
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsenselive.io
Apr 23, 2026OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers across cross-origin rCVE-2026-41345 · Other software · OpenClaw · reported by VulnCheckMedium 6
OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers across cross-origin redirects. Attackers can exploit this by crafting malicious cross-origin redirect chains to intercept sensitive authorization credentials intended for legitimate requests.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2026TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default web management credentials, making the CVE-2026-5039 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 6.1
TP-Link TL-WR841N v13 uses DES-CBC encryption in the TDDPv2 debug protocol with a cryptographic key derived from default web management credentials, making the key predictable if device is left in default configuration. A network-adjacent attacker can exploit this weakness to gain unauthorized access to the protocol, read debug data, modify certain device configuration values, and trigger device reboot, resulting in loss of integrity and a denial-of-service condition.
- Product
- TL-WL841N v13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 22, 2026ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commands with SYSTEM levelCVE-2018-25272 · Other software · Elba · reported by VulnCheckCritical 9.3
ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and execute arbitrary commands with SYSTEM level permissions. Attackers can connect to the database using default connector credentials, decrypt the DBA password, and execute commands via the xp_cmdshell stored procedure or add backdoor users to the BEDIENER table.
- Product
- ELBA5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2026OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections.CVE-2026-40045 · Other software · OpenClaw · reported by VulnCheckMedium 5.9
OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections. Attackers can forge discovery results or craft setup codes to redirect clients to malicious endpoints, disclosing plaintext gateway credentials.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which can be used to compromCVE-2026-33569 · Other software · Anviz · reported by ics-cert@hq.dhs.govMedium 6.5
Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which can be used to compromise the device.
- Product
- Anviz CX7 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026Anviz CrossChex Standard is vulnerable when an attacker manipulates the TDS7 PreLogin to disable encryption, causing database credentials to be sent in plainteCVE-2026-32650 · Other software · Anviz · reported by ics-cert@hq.dhs.govHigh 7.5
Anviz CrossChex Standard is vulnerable when an attacker manipulates the TDS7 PreLogin to disable encryption, causing database credentials to be sent in plaintext and enabling unauthorized database access.
- Product
- Anviz CrossChex Standard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd.CVE-2025-15622 · Other software · Sparx Systems Pty Ltd. · reported by db4dfee8-a97e-4877-bfae-eba6d14a2166Medium 6.2
Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an access and id tokens as part of the OpenID authentication flow.
- Product
- Sparx Enterprise Architect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026Insufficiently Protected Credentials in Sparx Systems Pty Ltd.CVE-2025-15621 · Other software · Sparx Systems Pty Ltd. · reported by db4dfee8-a97e-4877-bfae-eba6d14a2166Medium 5.7
Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication
- Product
- Sparx Enterprise Architect
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2026CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network accessCVE-2026-5189 · Other software · Sonatype · reported by 103e4ec9-0a87-450b-af77-479448ddef11Critical 9.2
CWE-798: Use of Hard-coded Credentials in Sonatype Nexus Repository Manager versions 3.0.0 through 3.70.5 allows an unauthenticated attacker with network access to gain unauthorized read/write access to the internal database and execute arbitrary OS commands as the Nexus process user. Exploitation requires the non-default nexus.orient.binaryListenerEnabled=true configuration to be enabled.
- Product
- Nexus Repository
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.sonatype.comsupport.sonatype.com
Apr 14, 2026Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.CVE-2026-32171 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
- Product
- Azure Logic Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2026CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive device information when an unauthenticated attackerCVE-2026-4832 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 6.9
CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive device information when an unauthenticated attacker is able to interrogate the SNMP port.
- Product
- Easergy MiCOM P14x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Apr 14, 2026CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application user credentials to reset when a Web AdmCVE-2026-2400 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.3
CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application user credentials to reset when a Web Admin user alters the POST /setPCBEDesc request payload.
- Product
- PowerChute™ Serial Shutdown
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.com
Apr 14, 2026A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 througCVE-2026-27316 · Network & remote access · Fortinet · reported by psirt@fortinet.comLow 2.7
A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5 may allow an authenticathed administrator to read LDAP server credentials via client-side inspection.
- Product
- FortiSandbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.fortinet.com
Apr 13, 2026An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to obtain UniFi Play WiFi credentials.CVE-2026-22566 · Network & remote access · Ubiquiti Inc · reported by support@hackerone.comHigh 7.5
An Improper Access Control vulnerability could allow a malicious actor with access to the UniFi Play network to obtain UniFi Play WiFi credentials. Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier) UniFi Play Audio Port (Version 1.0.24 and earlier) Mitigation: Update UniFi Play PowerAmp to Version 1.0.38 or later Update UniFi Play Audio Port to Version 1.1.9 or later
- Product
- UniFi Play PowerAmp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2026Heatmiser Wifi Thermostat 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials by tricking authentiCVE-2019-25708 · Other software · Heatmiser · reported by VulnCheckMedium 5.3
Heatmiser Wifi Thermostat 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials by tricking authenticated users into submitting malicious requests. Attackers can craft HTML forms targeting the networkSetup.htm endpoint with parameters usnm, usps, and cfps to modify the admin username and password without user consent.
- Product
- Heatmiser Wifi Thermostat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comvulncheck.com
Apr 9, 2026OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in chanCVE-2026-35644 · Other software · OpenClaw · reported by VulnCheckHigh 7.1
OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in channel baseUrl and httpUrl fields. Attackers can access gateway snapshots via config.get and channels.status endpoints to retrieve sensitive authentication information from URL userinfo components.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive informatioCVE-2026-35556 · Other software · OpenPLC_V3 · reported by ics-cert@hq.dhs.govCritical 9.2
OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive information.
- Product
- OpenPLC_V3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting.CVE-2025-15480 · Other software · Canonical · reported by security@ubuntu.comLow 2.7
In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.
- Product
- Ubuntu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting.CVE-2025-14551 · Other software · Canonical · reported by security@ubuntu.comLow 2.7
In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs.
- Product
- Ubuntu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.CVE-2026-4113 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 7.2
An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.
- Product
- SMA1000
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.com
Apr 7, 2026An issue that could allow a credential to be updated and used for a task from outside of the authorized organization scope has been resolved.CVE-2026-5384 · Other software · runZero · reported by 44488dab-36db-4358-99f9-bc116477f914Medium 5.8
An issue that could allow a credential to be updated and used for a task from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N (5.8 Medium). This issue was fixed in version 4.0.26021.0 of the runZero Platform.
- Product
- Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.runzero.comrunzero.com
Apr 7, 2026An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved.CVE-2026-5380 · Other software · runZero · reported by 44488dab-36db-4358-99f9-bc116477f914Medium 5.3
An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved. This is an instance of CWE-522: Insufficiently Protected Credentials, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (5.3 Medium). This issue was fixed in version 4.0.260204.2 of the runZero Platform.
- Product
- Platform
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelp.runzero.comrunzero.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.