Monthly
Kruize Autotune's unauthenticated REST API returns configured monitoring-datasource credentials-basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets-in cleartext through GET /datasources and the datasource-metadata endpoint. The flaw affects Autotune deployments where at least one monitoring datasource has authentication secrets configured; no specific version range is stated in the provided data. Attackers who can reach the service from an adjacent network can harvest those credentials and reuse them against the backing monitoring stack; no public exploit was identified at time of analysis, and the CVSS score is 7.4 with an adjacent attack vector.
Slican's WebCTI subscriber service for IPx telephone exchanges stores the temporary subscriber password in plaintext, so anyone able to read the backend database can recover the credential and authenticate as that subscriber. Only IPx deployments running WebCTI on versions prior to 6.62.0100 are affected, and the practical gate is prior read access to the database (an insider, stolen or default DB credentials, an exposed datastore, or a chained flaw), so this is best characterized as a credential-recovery weakness triggered after some other access is obtained rather than a directly reachable entry point; the assessed vector (CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) reflects that high-privilege prerequisite, while the CVSS 4.0 data rates it 8.2 with AT:P. Exposure is confidentiality-only (CWE-256) with no integrity or availability impact, there is no evidence of exploitation, and no public exploit code exists; no KEV listing and no EPSS signal were provided. Because the stored secret is described as a temporary password, the exploitation window and account scope may be limited by provisioning lifetime.
Plaintext logging of API keys in Plane (makeplane/plane) prior to 1.4.0 lets an authenticated low-privilege user who can read application logs harvest other users' long-lived API tokens and use them to escalate privileges, potentially including to administrative accounts. The vulnerable behavior is inherent to affected versions - the APITokenLogMiddleware component writes API keys into request/application logs in cleartext - and exploitation requires both a valid low-privilege account (CVSS PR:L) and visibility into the resulting log output; if logs are restricted to admins or shipped to a protected external sink, the realistic exposure narrows to insiders or anyone who can reach the log store. No public exploit code or confirmed active exploitation has been identified at time of analysis and no EPSS signal was supplied; overall this is a credible, moderately-high-priority issue rather than a drop-everything emergency, and it is fixed in Plane 1.4.0.
IBM Guardium Data Protection 12.2 stores internal REST service-account credentials in a reversible, plaintext-equivalent format (CWE-256), so an authenticated attacker who can read that stored value can recover the underlying password and mint an administrative REST access token. The flaw is network-reachable but requires a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the ability to reach the credential storage location, which makes it condition-dependent rather than mass-exploitable - SSVC rates exploitation as none and automatable as no, EPSS sits at 0.24% (13th percentile), and no public exploit code or CISA KEV entry is associated with the issue. A vendor patch is available, so the practical risk is concentrated in unpatched 12.2 deployments where low-privileged or delegated accounts exist.
Plaintext password storage in Menulux Portal (CWE-256) exposes embedded credentials to any low-privileged authenticated user over the network. All portal versions prior to build 20260903211448 are affected. Disclosed by TR-CERT; no public exploit code or active exploitation has been identified at time of analysis, though the High CVSS confidentiality rating reflects full credential retrieval capability.
Cleartext password storage in rust-iot-platform (through commit 5df942ab) enables unauthenticated network attackers to harvest plaintext credentials for every registered account by querying standard user retrieval and listing API routes. The root cause is CWE-256: the user model persists passwords without hashing, and those fields are then serialized into API responses without sanitization. No public exploit code or CISA KEV listing has been identified at time of analysis, but the triviality of exploitation - a plain HTTP GET to an exposed endpoint - makes CVSS 4.0's 8.7 score a credible reflection of real-world risk for any internet-exposed deployment.
Cleartext password exposure in CloudNativePG's PostgreSQL role management allows an authenticated low-privilege tenant to escalate to full operating-system command execution inside the database pod. Versions prior to 1.28.4, 1.29.2, and 1.30.0 embed raw cleartext passwords directly in ALTER ROLE and CREATE ROLE SQL statements; when pg_stat_statements is preloaded with track_utility=on, any tenant granted pg_monitor or pg_read_all_stats can harvest those credentials from query history. With the recovered superuser or application-owner password, the attacker reconnects and leverages PostgreSQL's COPY ... FROM PROGRAM to run arbitrary OS commands, achieving full cluster-pod compromise. No public exploit identified at time of analysis, but the attack chain is mechanically straightforward once prerequisites are met.
Plaintext password storage in Streamsoft Business Intelligence (BI) exposes every user's credential in recoverable form within the application database, meaning anyone able to read the database obtains working passwords directly rather than hashes. The flaw (CWE-256) affects all versions prior to 6.8.0.0, where the vendor introduced proper storage and forced a password change on first login after upgrade. There is no public exploit identified at time of analysis and it is not in CISA KEV; impact is confidentiality of credentials, amplified by likely password reuse across systems.
Plaintext storage of user account passwords in Weintek cMT3092X HMI firmware and EasyWeb exposes credentials to any network-based attacker with low-privileged authenticated access. Successful exploitation leads to full confidentiality compromise as stored passwords can be read directly. No active exploitation or public exploit code has been identified, and a vendor patch is available.
Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to retrieve stored passwords in plaintext via the product's API, because credentials are never hashed or encrypted at rest. This industrial-network visualization tool is affected across all builds up to and including 3.2.1a14, and per the CVSS 4.0 vector the disclosure is reachable over the network without authentication (VC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the ICS-CERT advisory (ICSA-26-204-04) confirms the flaw.
Kruize Autotune's unauthenticated REST API returns configured monitoring-datasource credentials-basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets-in cleartext through GET /datasources and the datasource-metadata endpoint. The flaw affects Autotune deployments where at least one monitoring datasource has authentication secrets configured; no specific version range is stated in the provided data. Attackers who can reach the service from an adjacent network can harvest those credentials and reuse them against the backing monitoring stack; no public exploit was identified at time of analysis, and the CVSS score is 7.4 with an adjacent attack vector.
Slican's WebCTI subscriber service for IPx telephone exchanges stores the temporary subscriber password in plaintext, so anyone able to read the backend database can recover the credential and authenticate as that subscriber. Only IPx deployments running WebCTI on versions prior to 6.62.0100 are affected, and the practical gate is prior read access to the database (an insider, stolen or default DB credentials, an exposed datastore, or a chained flaw), so this is best characterized as a credential-recovery weakness triggered after some other access is obtained rather than a directly reachable entry point; the assessed vector (CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) reflects that high-privilege prerequisite, while the CVSS 4.0 data rates it 8.2 with AT:P. Exposure is confidentiality-only (CWE-256) with no integrity or availability impact, there is no evidence of exploitation, and no public exploit code exists; no KEV listing and no EPSS signal were provided. Because the stored secret is described as a temporary password, the exploitation window and account scope may be limited by provisioning lifetime.
Plaintext logging of API keys in Plane (makeplane/plane) prior to 1.4.0 lets an authenticated low-privilege user who can read application logs harvest other users' long-lived API tokens and use them to escalate privileges, potentially including to administrative accounts. The vulnerable behavior is inherent to affected versions - the APITokenLogMiddleware component writes API keys into request/application logs in cleartext - and exploitation requires both a valid low-privilege account (CVSS PR:L) and visibility into the resulting log output; if logs are restricted to admins or shipped to a protected external sink, the realistic exposure narrows to insiders or anyone who can reach the log store. No public exploit code or confirmed active exploitation has been identified at time of analysis and no EPSS signal was supplied; overall this is a credible, moderately-high-priority issue rather than a drop-everything emergency, and it is fixed in Plane 1.4.0.
IBM Guardium Data Protection 12.2 stores internal REST service-account credentials in a reversible, plaintext-equivalent format (CWE-256), so an authenticated attacker who can read that stored value can recover the underlying password and mint an administrative REST access token. The flaw is network-reachable but requires a valid low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) and the ability to reach the credential storage location, which makes it condition-dependent rather than mass-exploitable - SSVC rates exploitation as none and automatable as no, EPSS sits at 0.24% (13th percentile), and no public exploit code or CISA KEV entry is associated with the issue. A vendor patch is available, so the practical risk is concentrated in unpatched 12.2 deployments where low-privileged or delegated accounts exist.
Plaintext password storage in Menulux Portal (CWE-256) exposes embedded credentials to any low-privileged authenticated user over the network. All portal versions prior to build 20260903211448 are affected. Disclosed by TR-CERT; no public exploit code or active exploitation has been identified at time of analysis, though the High CVSS confidentiality rating reflects full credential retrieval capability.
Cleartext password storage in rust-iot-platform (through commit 5df942ab) enables unauthenticated network attackers to harvest plaintext credentials for every registered account by querying standard user retrieval and listing API routes. The root cause is CWE-256: the user model persists passwords without hashing, and those fields are then serialized into API responses without sanitization. No public exploit code or CISA KEV listing has been identified at time of analysis, but the triviality of exploitation - a plain HTTP GET to an exposed endpoint - makes CVSS 4.0's 8.7 score a credible reflection of real-world risk for any internet-exposed deployment.
Cleartext password exposure in CloudNativePG's PostgreSQL role management allows an authenticated low-privilege tenant to escalate to full operating-system command execution inside the database pod. Versions prior to 1.28.4, 1.29.2, and 1.30.0 embed raw cleartext passwords directly in ALTER ROLE and CREATE ROLE SQL statements; when pg_stat_statements is preloaded with track_utility=on, any tenant granted pg_monitor or pg_read_all_stats can harvest those credentials from query history. With the recovered superuser or application-owner password, the attacker reconnects and leverages PostgreSQL's COPY ... FROM PROGRAM to run arbitrary OS commands, achieving full cluster-pod compromise. No public exploit identified at time of analysis, but the attack chain is mechanically straightforward once prerequisites are met.
Plaintext password storage in Streamsoft Business Intelligence (BI) exposes every user's credential in recoverable form within the application database, meaning anyone able to read the database obtains working passwords directly rather than hashes. The flaw (CWE-256) affects all versions prior to 6.8.0.0, where the vendor introduced proper storage and forced a password change on first login after upgrade. There is no public exploit identified at time of analysis and it is not in CISA KEV; impact is confidentiality of credentials, amplified by likely password reuse across systems.
Plaintext storage of user account passwords in Weintek cMT3092X HMI firmware and EasyWeb exposes credentials to any network-based attacker with low-privileged authenticated access. Successful exploitation leads to full confidentiality compromise as stored passwords can be read directly. No active exploitation or public exploit code has been identified, and a vendor patch is available.
Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to retrieve stored passwords in plaintext via the product's API, because credentials are never hashed or encrypted at rest. This industrial-network visualization tool is affected across all builds up to and including 3.2.1a14, and per the CVSS 4.0 vector the disclosure is reachable over the network without authentication (VC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the ICS-CERT advisory (ICSA-26-204-04) confirms the flaw.