Monthly
HTTPX2's SOCKS5 proxy implementation omits TLS negotiation for WebSocket Secure (wss://) origins, exposing the full WebSocket session - opening handshake, query parameters, Authorization headers, cookies, and message frames - in plaintext to anyone who can observe or control the proxy path. Affected are applications using Client.websocket() or AsyncClient.websocket() in HTTPX2 versions 2.6.0 through 2.9.1 when routing through a SOCKS5 proxy. An adjacent-network attacker can passively eavesdrop on or actively modify traffic, and can impersonate the WebSocket server due to the missing certificate verification step. No public exploit code has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
Scrapy's S3DownloadHandler transmitted s3:// requests - including signed AWS Authorization headers, temporary session tokens, and full S3 object contents - over plaintext HTTP by default in all versions prior to 2.17.0, exposing credentials and data to any network attacker with a man-in-the-middle position. A passive observer on the network path can harvest AWS credentials silently; an active attacker can modify S3 response bodies, status codes, and headers to poison scraped data exports, corrupt HTTP caches, or manipulate subsequent crawl targets through forged redirects. The root cause is a logic inversion in a single line of s3.py: HTTPS was opt-in rather than opt-out. No public exploit has been identified at time of analysis, and a patched release (2.17.0) is confirmed available.
Information disclosure in HPE AOS-CX exposes sensitive API endpoint data to a remote unauthenticated attacker who can achieve a man-in-the-middle position on the network path. Intercepted data could include credentials, session tokens, or configuration material usable to further compromise the affected switch or pivot into managed network infrastructure. This CVE is part of a broader HPE advisory (hpesbnw05134) covering at least four additional AOS-CX vulnerabilities; no public exploit code and no CISA KEV listing have been identified.
Unauthenticated remote information disclosure in HPE Networking Fabric Composer exposes cleartext data through the web-based management interface to network-positioned attackers. Exploitation demands high attack complexity (CVSS AC:H), constraining real-world risk despite the network-accessible, no-authentication vector. The vendor advisory identifies remediation; no public exploit code or CISA KEV listing has been identified, though the disclosed data could enable secondary compromise of dependent network infrastructure.
Cleartext password disclosure in MariaDB Connector/R2DBC (org.mariadb:r2dbc-mariadb) prior to 1.4.1 allows a network-positioned attacker posing as a database server to harvest user credentials during authentication. The connector's AuthenticationPlugin interface lacked any requireSecure() gate, so plugins transmitting credentials in cleartext - mysql_clear_password and PAM/dialog - could be triggered by a forged AuthSwitchRequest over an unencrypted plain-TCP connection, causing the client to respond with the user's database password as raw bytes on the wire. No public exploit code has been identified and no KEV listing exists; the issue is fully patched in version 1.4.1.
MariaDB Connector/J exposes database account passwords in cleartext to on-path attackers or hostile servers when PAM (dialog) authentication is used over plain TCP. The driver's PAM handler (SendPamAuthPacketFactory, plugin name 'dialog') failed to override the requireSsl() gate that correctly protects its sibling mysql_clear_password plugin, inheriting a default value of false and thus omitting the secure-transport requirement. Under the default connector configuration (sslMode=DISABLE, restrictedAuth=null), a man-in-the-middle or rogue server can issue an Authentication Switch Request for the dialog plugin and receive the account password in cleartext, granting full credential reuse against the real database. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack mechanics are straightforward for any on-path attacker against affected deployments.
PAM dialog authentication in MariaDB Connector/Node.js discloses account passwords in cleartext when connections use plain TCP, because the SendPamAuthPacketFactory handler omitted the secure-transport gate that was already applied to the sibling mysql_clear_password plugin. Applications connecting to MariaDB with default settings (sslMode=DISABLE, restrictedAuth=null) over untrusted network paths are exposed to credential theft by any on-path attacker or rogue server that issues an Authentication Switch Request for the dialog plugin. No active exploitation or public exploit code has been identified; vendor-released patches are available across all active 3.x branches.
Cleartext transmission of MQTT credentials and control traffic in Ebyte NE2-D11 firmware allows network-positioned attackers to intercept authentication material and message payloads, then impersonate devices and disrupt messaging. The flaw affects the NE2-D11 serial-to-Ethernet/MQTT gateway and was disclosed via CISA ICS advisory ICSA-26-237-06 (reported by ICS-CERT). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface exposes credentials to any attacker capable of intercepting network traffic between a user and the device. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects that no authentication is required on the attacker side - only network traffic access is needed to harvest management credentials, which then enable full unauthorized access to device management functionality. Reported by CISA ICS-CERT under advisory ICSA-26-237-06, this vulnerability affects OT/industrial gateway hardware where flat network topologies are common, elevating realistic exploitation risk beyond typical enterprise environments. No public exploit identified at time of analysis and no CISA KEV listing.
Cleartext transmission of OAuth credentials in RooCodeInc Roo-Code up to version 3.51.1 exposes sensitive OAuth tokens to interception via the OAuth callback handler in src/integrations/claude-code/oauth.ts. The vendor has officially archived the repository and explicitly discourages continued use, meaning no patch will be issued. A public proof-of-concept is available on GitHub, though high attack complexity (requiring a network interception position) constrains opportunistic exploitation.
HTTPX2's SOCKS5 proxy implementation omits TLS negotiation for WebSocket Secure (wss://) origins, exposing the full WebSocket session - opening handshake, query parameters, Authorization headers, cookies, and message frames - in plaintext to anyone who can observe or control the proxy path. Affected are applications using Client.websocket() or AsyncClient.websocket() in HTTPX2 versions 2.6.0 through 2.9.1 when routing through a SOCKS5 proxy. An adjacent-network attacker can passively eavesdrop on or actively modify traffic, and can impersonate the WebSocket server due to the missing certificate verification step. No public exploit code has been identified at time of analysis and this CVE does not appear in the CISA KEV catalog.
Scrapy's S3DownloadHandler transmitted s3:// requests - including signed AWS Authorization headers, temporary session tokens, and full S3 object contents - over plaintext HTTP by default in all versions prior to 2.17.0, exposing credentials and data to any network attacker with a man-in-the-middle position. A passive observer on the network path can harvest AWS credentials silently; an active attacker can modify S3 response bodies, status codes, and headers to poison scraped data exports, corrupt HTTP caches, or manipulate subsequent crawl targets through forged redirects. The root cause is a logic inversion in a single line of s3.py: HTTPS was opt-in rather than opt-out. No public exploit has been identified at time of analysis, and a patched release (2.17.0) is confirmed available.
Information disclosure in HPE AOS-CX exposes sensitive API endpoint data to a remote unauthenticated attacker who can achieve a man-in-the-middle position on the network path. Intercepted data could include credentials, session tokens, or configuration material usable to further compromise the affected switch or pivot into managed network infrastructure. This CVE is part of a broader HPE advisory (hpesbnw05134) covering at least four additional AOS-CX vulnerabilities; no public exploit code and no CISA KEV listing have been identified.
Unauthenticated remote information disclosure in HPE Networking Fabric Composer exposes cleartext data through the web-based management interface to network-positioned attackers. Exploitation demands high attack complexity (CVSS AC:H), constraining real-world risk despite the network-accessible, no-authentication vector. The vendor advisory identifies remediation; no public exploit code or CISA KEV listing has been identified, though the disclosed data could enable secondary compromise of dependent network infrastructure.
Cleartext password disclosure in MariaDB Connector/R2DBC (org.mariadb:r2dbc-mariadb) prior to 1.4.1 allows a network-positioned attacker posing as a database server to harvest user credentials during authentication. The connector's AuthenticationPlugin interface lacked any requireSecure() gate, so plugins transmitting credentials in cleartext - mysql_clear_password and PAM/dialog - could be triggered by a forged AuthSwitchRequest over an unencrypted plain-TCP connection, causing the client to respond with the user's database password as raw bytes on the wire. No public exploit code has been identified and no KEV listing exists; the issue is fully patched in version 1.4.1.
MariaDB Connector/J exposes database account passwords in cleartext to on-path attackers or hostile servers when PAM (dialog) authentication is used over plain TCP. The driver's PAM handler (SendPamAuthPacketFactory, plugin name 'dialog') failed to override the requireSsl() gate that correctly protects its sibling mysql_clear_password plugin, inheriting a default value of false and thus omitting the secure-transport requirement. Under the default connector configuration (sslMode=DISABLE, restrictedAuth=null), a man-in-the-middle or rogue server can issue an Authentication Switch Request for the dialog plugin and receive the account password in cleartext, granting full credential reuse against the real database. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack mechanics are straightforward for any on-path attacker against affected deployments.
PAM dialog authentication in MariaDB Connector/Node.js discloses account passwords in cleartext when connections use plain TCP, because the SendPamAuthPacketFactory handler omitted the secure-transport gate that was already applied to the sibling mysql_clear_password plugin. Applications connecting to MariaDB with default settings (sslMode=DISABLE, restrictedAuth=null) over untrusted network paths are exposed to credential theft by any on-path attacker or rogue server that issues an Authentication Switch Request for the dialog plugin. No active exploitation or public exploit code has been identified; vendor-released patches are available across all active 3.x branches.
Cleartext transmission of MQTT credentials and control traffic in Ebyte NE2-D11 firmware allows network-positioned attackers to intercept authentication material and message payloads, then impersonate devices and disrupt messaging. The flaw affects the NE2-D11 serial-to-Ethernet/MQTT gateway and was disclosed via CISA ICS advisory ICSA-26-237-06 (reported by ICS-CERT). No public exploit is identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
Cleartext transmission of authentication and session credentials in the Ebyte NE2-D11 gateway web management interface exposes credentials to any attacker capable of intercepting network traffic between a user and the device. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) reflects that no authentication is required on the attacker side - only network traffic access is needed to harvest management credentials, which then enable full unauthorized access to device management functionality. Reported by CISA ICS-CERT under advisory ICSA-26-237-06, this vulnerability affects OT/industrial gateway hardware where flat network topologies are common, elevating realistic exploitation risk beyond typical enterprise environments. No public exploit identified at time of analysis and no CISA KEV listing.
Cleartext transmission of OAuth credentials in RooCodeInc Roo-Code up to version 3.51.1 exposes sensitive OAuth tokens to interception via the OAuth callback handler in src/integrations/claude-code/oauth.ts. The vendor has officially archived the repository and explicitly discourages continued use, meaning no patch will be issued. A public proof-of-concept is available on GitHub, though high attack complexity (requiring a network interception position) constrains opportunistic exploitation.