Monthly
Cleartext password storage in rust-iot-platform (through commit 5df942ab) enables unauthenticated network attackers to harvest plaintext credentials for every registered account by querying standard user retrieval and listing API routes. The root cause is CWE-256: the user model persists passwords without hashing, and those fields are then serialized into API responses without sanitization. No public exploit code or CISA KEV listing has been identified at time of analysis, but the triviality of exploitation - a plain HTTP GET to an exposed endpoint - makes CVSS 4.0's 8.7 score a credible reflection of real-world risk for any internet-exposed deployment.
Cleartext password exposure in CloudNativePG's PostgreSQL role management allows an authenticated low-privilege tenant to escalate to full operating-system command execution inside the database pod. Versions prior to 1.28.4, 1.29.2, and 1.30.0 embed raw cleartext passwords directly in ALTER ROLE and CREATE ROLE SQL statements; when pg_stat_statements is preloaded with track_utility=on, any tenant granted pg_monitor or pg_read_all_stats can harvest those credentials from query history. With the recovered superuser or application-owner password, the attacker reconnects and leverages PostgreSQL's COPY ... FROM PROGRAM to run arbitrary OS commands, achieving full cluster-pod compromise. No public exploit identified at time of analysis, but the attack chain is mechanically straightforward once prerequisites are met.
Plaintext password storage in Streamsoft Business Intelligence (BI) exposes every user's credential in recoverable form within the application database, meaning anyone able to read the database obtains working passwords directly rather than hashes. The flaw (CWE-256) affects all versions prior to 6.8.0.0, where the vendor introduced proper storage and forced a password change on first login after upgrade. There is no public exploit identified at time of analysis and it is not in CISA KEV; impact is confidentiality of credentials, amplified by likely password reuse across systems.
Privilege escalation in Quick.Cart via hard-coded, plaintext admin credentials stored in a configuration file allows local attackers with file system access to retrieve authentication details and gain administrative control. The vendor considers exploitation unlikely and has not released a fix; all versions are believed vulnerable, with version 6.7 confirmed. No public exploit or active exploitation has been reported.
Plaintext storage of user account passwords in Weintek cMT3092X HMI firmware and EasyWeb exposes credentials to any network-based attacker with low-privileged authenticated access. Successful exploitation leads to full confidentiality compromise as stored passwords can be read directly. No active exploitation or public exploit code has been identified, and a vendor patch is available.
Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to retrieve stored passwords in plaintext via the product's API, because credentials are never hashed or encrypted at rest. This industrial-network visualization tool is affected across all builds up to and including 3.2.1a14, and per the CVSS 4.0 vector the disclosure is reachable over the network without authentication (VC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the ICS-CERT advisory (ICSA-26-204-04) confirms the flaw.
Insecure credential storage in the Ansible Lightspeed VS Code extension exposes Google Gemini API keys to any local actor operating at user privilege level. The extension writes API keys in plaintext to both user configuration files and extension output log channels, making them readable by co-users of the workstation, other OS-level processes, or malware executing under the victim's account. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the primary real-world risk is API credential theft leading to unauthorized quota consumption or service abuse.
Sensitive credential exposure in Frogman (an mwtcmi FreePBX module providing headless PBX control via MCP and an HTTP API) before 1.6.2 stores API tokens in cleartext, so any read of the oc_api_tokens database table yields fully reusable, active tokens at their assigned permission level - up to admin. Because Frogman.class.php authenticated the X-Frogman-Token header by directly comparing the presented value against the stored raw string, a leaked or read database directly hands an attacker working credentials. Rated CVSS 7.4 (high); no public exploit identified at time of analysis, and the issue is fixed in version 1.6.2.
Insecure credential storage in PcVue exposes built-in user account passwords to any local attacker with low-privileged filesystem access, across all versions prior to 17.0.0. The credentials are stored unprotected in the project's User directory, recoverable without elevated OS privileges. No public exploit code has been identified at time of analysis, but in OT/SCADA environments where PcVue is deployed, recovered credentials could enable unauthorized control of industrial processes.
Cleartext password storage in Netflix Lemur's user-update service path allows any attacker who gains read access to the Lemur database, its backups, query logs, or read replicas to obtain directly usable plaintext credentials - no offline cracking required. The flaw affects all Lemur deployments running pip/lemur <= 1.9.1 and is triggered exclusively when an administrator resets a user password through the admin-gated PUT /api/1/users/<id> API endpoint. No public exploit is required: the advisory itself contains precise reproduction steps, and the side effect (immediate login failure for affected users) makes the exposure operationally detectable. No KEV listing exists at time of analysis.
Cleartext password storage in rust-iot-platform (through commit 5df942ab) enables unauthenticated network attackers to harvest plaintext credentials for every registered account by querying standard user retrieval and listing API routes. The root cause is CWE-256: the user model persists passwords without hashing, and those fields are then serialized into API responses without sanitization. No public exploit code or CISA KEV listing has been identified at time of analysis, but the triviality of exploitation - a plain HTTP GET to an exposed endpoint - makes CVSS 4.0's 8.7 score a credible reflection of real-world risk for any internet-exposed deployment.
Cleartext password exposure in CloudNativePG's PostgreSQL role management allows an authenticated low-privilege tenant to escalate to full operating-system command execution inside the database pod. Versions prior to 1.28.4, 1.29.2, and 1.30.0 embed raw cleartext passwords directly in ALTER ROLE and CREATE ROLE SQL statements; when pg_stat_statements is preloaded with track_utility=on, any tenant granted pg_monitor or pg_read_all_stats can harvest those credentials from query history. With the recovered superuser or application-owner password, the attacker reconnects and leverages PostgreSQL's COPY ... FROM PROGRAM to run arbitrary OS commands, achieving full cluster-pod compromise. No public exploit identified at time of analysis, but the attack chain is mechanically straightforward once prerequisites are met.
Plaintext password storage in Streamsoft Business Intelligence (BI) exposes every user's credential in recoverable form within the application database, meaning anyone able to read the database obtains working passwords directly rather than hashes. The flaw (CWE-256) affects all versions prior to 6.8.0.0, where the vendor introduced proper storage and forced a password change on first login after upgrade. There is no public exploit identified at time of analysis and it is not in CISA KEV; impact is confidentiality of credentials, amplified by likely password reuse across systems.
Privilege escalation in Quick.Cart via hard-coded, plaintext admin credentials stored in a configuration file allows local attackers with file system access to retrieve authentication details and gain administrative control. The vendor considers exploitation unlikely and has not released a fix; all versions are believed vulnerable, with version 6.7 confirmed. No public exploit or active exploitation has been reported.
Plaintext storage of user account passwords in Weintek cMT3092X HMI firmware and EasyWeb exposes credentials to any network-based attacker with low-privileged authenticated access. Successful exploitation leads to full confidentiality compromise as stored passwords can be read directly. No active exploitation or public exploit code has been identified, and a vendor patch is available.
Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to retrieve stored passwords in plaintext via the product's API, because credentials are never hashed or encrypted at rest. This industrial-network visualization tool is affected across all builds up to and including 3.2.1a14, and per the CVSS 4.0 vector the disclosure is reachable over the network without authentication (VC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the ICS-CERT advisory (ICSA-26-204-04) confirms the flaw.
Insecure credential storage in the Ansible Lightspeed VS Code extension exposes Google Gemini API keys to any local actor operating at user privilege level. The extension writes API keys in plaintext to both user configuration files and extension output log channels, making them readable by co-users of the workstation, other OS-level processes, or malware executing under the victim's account. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the primary real-world risk is API credential theft leading to unauthorized quota consumption or service abuse.
Sensitive credential exposure in Frogman (an mwtcmi FreePBX module providing headless PBX control via MCP and an HTTP API) before 1.6.2 stores API tokens in cleartext, so any read of the oc_api_tokens database table yields fully reusable, active tokens at their assigned permission level - up to admin. Because Frogman.class.php authenticated the X-Frogman-Token header by directly comparing the presented value against the stored raw string, a leaked or read database directly hands an attacker working credentials. Rated CVSS 7.4 (high); no public exploit identified at time of analysis, and the issue is fixed in version 1.6.2.
Insecure credential storage in PcVue exposes built-in user account passwords to any local attacker with low-privileged filesystem access, across all versions prior to 17.0.0. The credentials are stored unprotected in the project's User directory, recoverable without elevated OS privileges. No public exploit code has been identified at time of analysis, but in OT/SCADA environments where PcVue is deployed, recovered credentials could enable unauthorized control of industrial processes.
Cleartext password storage in Netflix Lemur's user-update service path allows any attacker who gains read access to the Lemur database, its backups, query logs, or read replicas to obtain directly usable plaintext credentials - no offline cracking required. The flaw affects all Lemur deployments running pip/lemur <= 1.9.1 and is triggered exclusively when an administrator resets a user password through the admin-gated PUT /api/1/users/<id> API endpoint. No public exploit is required: the advisory itself contains precise reproduction steps, and the side effect (immediate login failure for affected users) makes the exposure operationally detectable. No KEV listing exists at time of analysis.