Monthly
Cleartext storage of external identity provider tokens and active session identifiers in the Devolutions Server backend database means anyone who already holds read access to those records can recover reusable credentials and replay them to impersonate users. The affected code is Devolutions Server 2026.3.5.0 and earlier; ENISA's EUVD entry narrows the affected range to all Server builds below 2026.3.7.0. Exploitation is gated by a significant prerequisite: the attacker must already have read access to the database tier, such as compromised database credentials, a leaked or stolen database backup, a privileged/malicious DBA, or a separate injection flaw, so the vendor rates it 7.2 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) while our assessment scores the same scope change with low attack complexity and limited integrity impact (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N). No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and the issue is not in CISA KEV. The real risk is post-disclosure: recovered session identifiers and IdP tokens remain valid for replay, which is why the scope change drives the elevated score despite the local, high-privilege prerequisite.
The RabbitMQ management plugin in versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2 writes an 'auth' cookie containing the base64-encoded 'username:password' pair after a successful POST /login, with no HttpOnly, Secure, SameSite, or expiration attributes, so anyone who can read that cookie can trivially decode it back to plaintext administrator credentials. The flaw is not directly exploitable on its own: the attacker must also hold one of three separate primitives - a same-origin cross-site scripting foothold in the management UI, an HTTP-readable network position (cleartext or man-in-the-middle), or local read access to the victim's browser cookie store - which is why the vendor's 8.2 (CVSS 4.0, AT:P/AC:H) score overstates practical risk while the underlying confidentiality impact is high. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor fixes are available in RabbitMQ 4.2.8 and 4.3.2.
Silent, warning-free failure of encryption-configuration generation in the Mongoid object-document mapper causes fields that an application explicitly declared for client-side field-level encryption (CSFLE) to be written to MongoDB as cleartext, allowing any party with ordinary read access to the database - a DBA, a read replica, a backup, or a lower-privilege account with query rights - to read values that were intended to be protected from them. Only applications built on Mongoid that use MongoDB CSFLE and declare fields for encryption are affected; the CVSS vectors (the supplied 4.0 vector with PR:L and the independently assessed 3.1 vector with PR:L) indicate the attacker requires some existing privilege, consistent with the assessed precondition of ordinary database read access rather than an unauthenticated remote path. No public exploit code has been identified at time of analysis, and this is assessed as a genuine but conditional data-protection failure rather than an actively exploited priority.
Mongoid can silently persist values in readable form that applications intended to encrypt, because its client-side field-level encryption (CSFLE) schema generation omits encryption rules for fields declared on embedded models - the MongoDB driver then writes those values unencrypted with no error or warning. The exposure is limited to applications that both enable CSFLE and declare encrypted fields on embedded documents (top-level fields are not implicated), and to parties who already hold read access to the database, a backup, or the underlying on-disk data files; there is no write, integrity, or availability impact and no remote code execution. Data-level risk is real but bounded: no public exploit code identified at time of analysis, no confirmed active exploitation, and the reported CVSS 4.0 base score of 7.1 is consistent with the independent CVSS 3.1 assessment of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Cleartext storage of wireless network credentials in CM2507 IP cameras running HMT.CM2507 firmware v251211.1507 lets anyone who already holds the device's filesystem read the configured SSID and pre-shared key directly, with no cracking, decryption, or privilege escalation required once that access exists. Reaching the filesystem requires physical possession of the camera, use of an exposed on-board debugging interface, or chaining a separate vulnerability; it is not remotely reachable against a default network-facing configuration. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, and the vendor's CVSS 4.0 score of 9.3 (AV:N) materially overstates real-world risk - our independent assessment scores it CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (approximately 3.7, Low), since impact is confined to disclosure of stored Wi-Fi credentials with no integrity or availability effect on the camera itself.
Cleartext storage of sensitive information in NI SystemLink and NI SystemLink Server (all versions through 2026 Q3, ≤26.5.0) allows a local low-privileged user to read credentials, API keys, or other secrets written to disk without encryption. The vulnerability is rooted in CWE-312 and carries a CVSS 4.0 score of 8.4, reflecting high confidentiality and integrity impact for local access. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cleartext HMAC key exposure in Amazon SageMaker Python SDK's @step and @remote decorator components (versions before v2.256.0 and v3.11.0) lets any authenticated IAM principal within the same AWS account read the signing key from DescribePipeline API responses, then forge valid integrity signatures to inject attacker-controlled code into a victim user's pipeline execution context. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but the attack chain is mechanically straightforward for any account member holding the sagemaker:DescribePipeline permission. Vendor-released patches for both SDK branches are confirmed via GitHub release tags v2.256.0 and v3.11.0 and AWS Security Bulletin 2026-093-aws.
Credential exposure in Ebyte NE2-D11 firmware allows an unauthenticated adjacent-network attacker to recover administrative credentials from exported configuration files. The device exports sensitive configuration data - including credentials - without adequate protection (CWE-312: Cleartext Storage of Sensitive Information), meaning any attacker positioned on the local network who can access or intercept an exported configuration file gains valid credentials. Compromised credentials enable direct device access and, where the same credentials are reused, lateral movement to similarly configured Ebyte deployments. No public exploit or CISA KEV listing has been identified at time of analysis.
Cleartext private key exposure in openssl-encrypt (pip package by jahlives) versions 1.4.8 and earlier allows any local user to read a stored mTLS client private key from a world-readable SharedPreferences file. The desktop GUI's Settings screen writes the combined certificate and private key PEM directly into a 0644-permissioned file, making it accessible to all local users on the system without elevated privileges. No public exploit or CISA KEV listing exists at time of analysis, but the trivial exploitation path (read a world-readable file) means any local user on an affected host can silently exfiltrate the private key and use it to impersonate the legitimate mTLS client.
Cleartext storage of sensitive information in Apache CloudStack's AsyncJob database records exposes credentials and operation-sensitive data to any party with read access to the underlying database. All CloudStack deployments from version 4.0.0 through 4.22.1.0 are affected across both the 4.x stable and 4.21/4.22 release lines. No public exploit code has been identified and EPSS sits at the 1st percentile, but the NVD-assigned confidentiality impact of HIGH reflects that AsyncJob records may capture sensitive payloads - such as API secrets or passwords - passed through asynchronous operations, stored durably in cleartext rather than encrypted at rest.
Cleartext storage of external identity provider tokens and active session identifiers in the Devolutions Server backend database means anyone who already holds read access to those records can recover reusable credentials and replay them to impersonate users. The affected code is Devolutions Server 2026.3.5.0 and earlier; ENISA's EUVD entry narrows the affected range to all Server builds below 2026.3.7.0. Exploitation is gated by a significant prerequisite: the attacker must already have read access to the database tier, such as compromised database credentials, a leaked or stolen database backup, a privileged/malicious DBA, or a separate injection flaw, so the vendor rates it 7.2 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) while our assessment scores the same scope change with low attack complexity and limited integrity impact (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N). No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none with Automatable: no, and the issue is not in CISA KEV. The real risk is post-disclosure: recovered session identifiers and IdP tokens remain valid for replay, which is why the scope change drives the elevated score despite the local, high-privilege prerequisite.
The RabbitMQ management plugin in versions 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2 writes an 'auth' cookie containing the base64-encoded 'username:password' pair after a successful POST /login, with no HttpOnly, Secure, SameSite, or expiration attributes, so anyone who can read that cookie can trivially decode it back to plaintext administrator credentials. The flaw is not directly exploitable on its own: the attacker must also hold one of three separate primitives - a same-origin cross-site scripting foothold in the management UI, an HTTP-readable network position (cleartext or man-in-the-middle), or local read access to the victim's browser cookie store - which is why the vendor's 8.2 (CVSS 4.0, AT:P/AC:H) score overstates practical risk while the underlying confidentiality impact is high. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor fixes are available in RabbitMQ 4.2.8 and 4.3.2.
Silent, warning-free failure of encryption-configuration generation in the Mongoid object-document mapper causes fields that an application explicitly declared for client-side field-level encryption (CSFLE) to be written to MongoDB as cleartext, allowing any party with ordinary read access to the database - a DBA, a read replica, a backup, or a lower-privilege account with query rights - to read values that were intended to be protected from them. Only applications built on Mongoid that use MongoDB CSFLE and declare fields for encryption are affected; the CVSS vectors (the supplied 4.0 vector with PR:L and the independently assessed 3.1 vector with PR:L) indicate the attacker requires some existing privilege, consistent with the assessed precondition of ordinary database read access rather than an unauthenticated remote path. No public exploit code has been identified at time of analysis, and this is assessed as a genuine but conditional data-protection failure rather than an actively exploited priority.
Mongoid can silently persist values in readable form that applications intended to encrypt, because its client-side field-level encryption (CSFLE) schema generation omits encryption rules for fields declared on embedded models - the MongoDB driver then writes those values unencrypted with no error or warning. The exposure is limited to applications that both enable CSFLE and declare encrypted fields on embedded documents (top-level fields are not implicated), and to parties who already hold read access to the database, a backup, or the underlying on-disk data files; there is no write, integrity, or availability impact and no remote code execution. Data-level risk is real but bounded: no public exploit code identified at time of analysis, no confirmed active exploitation, and the reported CVSS 4.0 base score of 7.1 is consistent with the independent CVSS 3.1 assessment of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Cleartext storage of wireless network credentials in CM2507 IP cameras running HMT.CM2507 firmware v251211.1507 lets anyone who already holds the device's filesystem read the configured SSID and pre-shared key directly, with no cracking, decryption, or privilege escalation required once that access exists. Reaching the filesystem requires physical possession of the camera, use of an exposed on-board debugging interface, or chaining a separate vulnerability; it is not remotely reachable against a default network-facing configuration. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, and the vendor's CVSS 4.0 score of 9.3 (AV:N) materially overstates real-world risk - our independent assessment scores it CVSS 3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (approximately 3.7, Low), since impact is confined to disclosure of stored Wi-Fi credentials with no integrity or availability effect on the camera itself.
Cleartext storage of sensitive information in NI SystemLink and NI SystemLink Server (all versions through 2026 Q3, ≤26.5.0) allows a local low-privileged user to read credentials, API keys, or other secrets written to disk without encryption. The vulnerability is rooted in CWE-312 and carries a CVSS 4.0 score of 8.4, reflecting high confidentiality and integrity impact for local access. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cleartext HMAC key exposure in Amazon SageMaker Python SDK's @step and @remote decorator components (versions before v2.256.0 and v3.11.0) lets any authenticated IAM principal within the same AWS account read the signing key from DescribePipeline API responses, then forge valid integrity signatures to inject attacker-controlled code into a victim user's pipeline execution context. No public exploit has been identified and the vulnerability is absent from the CISA KEV catalog, but the attack chain is mechanically straightforward for any account member holding the sagemaker:DescribePipeline permission. Vendor-released patches for both SDK branches are confirmed via GitHub release tags v2.256.0 and v3.11.0 and AWS Security Bulletin 2026-093-aws.
Credential exposure in Ebyte NE2-D11 firmware allows an unauthenticated adjacent-network attacker to recover administrative credentials from exported configuration files. The device exports sensitive configuration data - including credentials - without adequate protection (CWE-312: Cleartext Storage of Sensitive Information), meaning any attacker positioned on the local network who can access or intercept an exported configuration file gains valid credentials. Compromised credentials enable direct device access and, where the same credentials are reused, lateral movement to similarly configured Ebyte deployments. No public exploit or CISA KEV listing has been identified at time of analysis.
Cleartext private key exposure in openssl-encrypt (pip package by jahlives) versions 1.4.8 and earlier allows any local user to read a stored mTLS client private key from a world-readable SharedPreferences file. The desktop GUI's Settings screen writes the combined certificate and private key PEM directly into a 0644-permissioned file, making it accessible to all local users on the system without elevated privileges. No public exploit or CISA KEV listing exists at time of analysis, but the trivial exploitation path (read a world-readable file) means any local user on an affected host can silently exfiltrate the private key and use it to impersonate the legitimate mTLS client.
Cleartext storage of sensitive information in Apache CloudStack's AsyncJob database records exposes credentials and operation-sensitive data to any party with read access to the underlying database. All CloudStack deployments from version 4.0.0 through 4.22.1.0 are affected across both the 4.x stable and 4.21/4.22 release lines. No public exploit code has been identified and EPSS sits at the 1st percentile, but the NVD-assigned confidentiality impact of HIGH reflects that AsyncJob records may capture sensitive payloads - such as API secrets or passwords - passed through asynchronous operations, stored durably in cleartext rather than encrypted at rest.