Monthly
Plaintext LDAP bind credentials are exposed in the administrative configuration interface of Trisolutions BRPerfX 1.4.4.0, allowing an attacker holding an authenticated administrator session to recover the directory credentials simply by viewing the delivered client-side code (view-source or browser developer tools). The exposure is inherent to the affected version - no victim interaction and no non-default configuration are required - but administrative authentication is a hard prerequisite, so the practical risk is lower than the 7.5 (High) base score suggests; EPSS is 0.31% (22nd percentile), SSVC records Exploitation: none, and no public exploit has been identified at time of analysis. The real impact depends on what the exposed LDAP account can reach: if it is a reused or privileged directory account, credential reuse pivots the finding from information disclosure into potential broader directory compromise.
Cookie header leakage in cpp-httplib before 0.51.0 causes session cookies to be forwarded to a different origin when the library's client follows a cross-origin 301, 302, 307, or 308 redirect. Remote attackers who control the redirect response - or who occupy a network man-in-the-middle position against a plaintext HTTP origin - can capture cookies intended for the original origin, with confidentiality-only impact rated CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation requires the consuming application to enable set_follow_location(true) and to supply cookies directly or via default_headers_, so unauthenticated remote attackers, not authenticated local users, drive the vector, and there is no public exploit identified at time of analysis.
Plaintext server-side storage of persistent remember-me tokens in Omnispace Agora Project before 26.10.0 allows anyone who obtains the stored token, such as through database or backup disclosure, to replay it as a bearer credential and authenticate as the victim without the victim's password. The replay step requires no password and, per the assessed CVSS vector with PR:N, no authentication, but exploitation depends on first reading the token from server-side storage and on the victim having used the persistent remember-me feature. It is not confirmed actively exploited (CISA KEV); no public exploit identified at time of analysis. The vendor addressed the issue in Agora Project 26.10.0.
Authenticated API clients of pH7Builder (pH7 Social Dating CMS) before 18.5.0 can retrieve sensitive member records - including bcrypt password hashes, non-expiring hashValidation password-reset tokens, and TOTP two-factor secrets - because the member API endpoints UserController::users() and user() return unfiltered database rows directly to the caller. Exploitation requires a valid private API key (PR:L) and network reachability to the exposed member API, so anonymous attackers cannot trigger it, but the leaked reset tokens never expire, removing any time window on their reuse. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor addressed it in 18.5.0 and via upstream commit 52a59da. This is a credible but bounded risk best characterized as medium-severity requiring authentication.
Plaintext credential storage in Red Lion Controls' 700 Series industrial devices exposes usernames, passwords, and unchanged factory-default credentials to anyone who can obtain the device configuration file, and at least one retrieval path - an SNMP-initiated TFTP export - is described as requiring no authentication. Administrators can also read the configuration through the CLI or export it via TFTP from the web interface, but those routes presume existing privileged access; the unauthenticated SNMP path is the exception that drives the risk rating. CISA ICS advisory ICSA-26-281-01 documents the issue, and our assessment scores it as a confidentiality-only, remotely reachable information-disclosure flaw (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, 7.5 High) rather than the 9.3 the CNA vector implies; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Insufficiently protected credentials in Rocket Software Rocket Remote Desktop 18.0.8583.1 can expose account secrets to an attacker who can reach the credential material, potentially compromising downstream systems that use those credentials. The CVE feeds rate the issue as 9.8 with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but our independent assessment is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N: local, authenticated, and confidentiality-only, because realistic impact depends on local access to a stored credential blob or a man-in-the-middle position on session traffic, and the exact exposed feature is not specified in the one-line description. EPSS is 0.14 percent at the 3rd percentile, and no public exploit identified at time of analysis or CISA KEV entry was provided.
EspoCRM deployments before 10.0.5 allow an authenticated user with Email Account scope to retrieve other users' stored IMAP passwords via an insecure direct object reference in PersonalAccount\Service, enabling mailbox compromise. Attackers must know or enumerate a victim's Email Account record ID, and publicly available exploit code exists; there is no confirmation of active exploitation (CISA KEV) at time of analysis. The vulnerability is a confidentiality-only issue with changed scope, rated high risk because it exposes reusable credentials.
Local credential theft in Brocade ASCG before 3.5.0 allows a low-privileged authenticated user on the ASCG VM to extract stored management credentials for onboarded SANnav instances by issuing requests into the SANnav host network namespace, enabling follow-on compromise of connected Brocade SANnav servers or managed Fibre Channel switches. The vulnerability is CWE-522 (insufficiently protected credentials) and requires an existing local foothold (CVSS vector AV:L/PR:L, no user interaction), so unauthenticated remote attackers cannot exploit it directly. No public exploit identified at time of analysis.
Remote, unauthenticated attackers can reach insufficiently protected credentials in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) and potentially read and modify them, based on Cisco's hardening advisory covering several internally discovered CWE-522 issues tracked under this single CVE. Cisco rates it CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating a network-reachable, low-complexity flaw requiring no privileges and no user interaction, with high confidentiality and integrity impact but no availability impact. The wildcard CPE cpe:2.3:a:cisco:cisco_license_on-prem:*:*:*:*:*:*:*:* indicates all shipping versions are affected until the vendor's hardening release is applied; no public exploit code or confirmed active exploitation was identified at time of analysis (no CISA KEV listing and no PoC referenced), and practical exposure is constrained because these on-prem appliances normally sit on internal management networks rather than the public internet.
Obot versions 0.12.0 through 0.26.1 return admin- and power-user-supplied static secrets (API keys, tokens) on MCP catalog entries in plaintext to any user who has been granted that entry through Obot's access-control rules, exposing credentials for abuse against backend services. Affected users need a valid Obot account at basic privilege plus an explicit grant on the target entry, and the entry must actually carry admin-set static configuration values, so anonymous exploitation is not possible and only a subset of catalog entries is reachable in practice; the assessed severity is moderate (CVSS 7.1, confidentiality-only impact with no integrity or availability loss). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); the vendor has released a fix in Obot v0.26.2.
Plaintext LDAP bind credentials are exposed in the administrative configuration interface of Trisolutions BRPerfX 1.4.4.0, allowing an attacker holding an authenticated administrator session to recover the directory credentials simply by viewing the delivered client-side code (view-source or browser developer tools). The exposure is inherent to the affected version - no victim interaction and no non-default configuration are required - but administrative authentication is a hard prerequisite, so the practical risk is lower than the 7.5 (High) base score suggests; EPSS is 0.31% (22nd percentile), SSVC records Exploitation: none, and no public exploit has been identified at time of analysis. The real impact depends on what the exposed LDAP account can reach: if it is a reused or privileged directory account, credential reuse pivots the finding from information disclosure into potential broader directory compromise.
Cookie header leakage in cpp-httplib before 0.51.0 causes session cookies to be forwarded to a different origin when the library's client follows a cross-origin 301, 302, 307, or 308 redirect. Remote attackers who control the redirect response - or who occupy a network man-in-the-middle position against a plaintext HTTP origin - can capture cookies intended for the original origin, with confidentiality-only impact rated CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exploitation requires the consuming application to enable set_follow_location(true) and to supply cookies directly or via default_headers_, so unauthenticated remote attackers, not authenticated local users, drive the vector, and there is no public exploit identified at time of analysis.
Plaintext server-side storage of persistent remember-me tokens in Omnispace Agora Project before 26.10.0 allows anyone who obtains the stored token, such as through database or backup disclosure, to replay it as a bearer credential and authenticate as the victim without the victim's password. The replay step requires no password and, per the assessed CVSS vector with PR:N, no authentication, but exploitation depends on first reading the token from server-side storage and on the victim having used the persistent remember-me feature. It is not confirmed actively exploited (CISA KEV); no public exploit identified at time of analysis. The vendor addressed the issue in Agora Project 26.10.0.
Authenticated API clients of pH7Builder (pH7 Social Dating CMS) before 18.5.0 can retrieve sensitive member records - including bcrypt password hashes, non-expiring hashValidation password-reset tokens, and TOTP two-factor secrets - because the member API endpoints UserController::users() and user() return unfiltered database rows directly to the caller. Exploitation requires a valid private API key (PR:L) and network reachability to the exposed member API, so anonymous attackers cannot trigger it, but the leaked reset tokens never expire, removing any time window on their reuse. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the vendor addressed it in 18.5.0 and via upstream commit 52a59da. This is a credible but bounded risk best characterized as medium-severity requiring authentication.
Plaintext credential storage in Red Lion Controls' 700 Series industrial devices exposes usernames, passwords, and unchanged factory-default credentials to anyone who can obtain the device configuration file, and at least one retrieval path - an SNMP-initiated TFTP export - is described as requiring no authentication. Administrators can also read the configuration through the CLI or export it via TFTP from the web interface, but those routes presume existing privileged access; the unauthenticated SNMP path is the exception that drives the risk rating. CISA ICS advisory ICSA-26-281-01 documents the issue, and our assessment scores it as a confidentiality-only, remotely reachable information-disclosure flaw (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, 7.5 High) rather than the 9.3 the CNA vector implies; no public exploit code and no confirmed active exploitation (no CISA KEV listing) were identified at time of analysis.
Insufficiently protected credentials in Rocket Software Rocket Remote Desktop 18.0.8583.1 can expose account secrets to an attacker who can reach the credential material, potentially compromising downstream systems that use those credentials. The CVE feeds rate the issue as 9.8 with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but our independent assessment is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N: local, authenticated, and confidentiality-only, because realistic impact depends on local access to a stored credential blob or a man-in-the-middle position on session traffic, and the exact exposed feature is not specified in the one-line description. EPSS is 0.14 percent at the 3rd percentile, and no public exploit identified at time of analysis or CISA KEV entry was provided.
EspoCRM deployments before 10.0.5 allow an authenticated user with Email Account scope to retrieve other users' stored IMAP passwords via an insecure direct object reference in PersonalAccount\Service, enabling mailbox compromise. Attackers must know or enumerate a victim's Email Account record ID, and publicly available exploit code exists; there is no confirmation of active exploitation (CISA KEV) at time of analysis. The vulnerability is a confidentiality-only issue with changed scope, rated high risk because it exposes reusable credentials.
Local credential theft in Brocade ASCG before 3.5.0 allows a low-privileged authenticated user on the ASCG VM to extract stored management credentials for onboarded SANnav instances by issuing requests into the SANnav host network namespace, enabling follow-on compromise of connected Brocade SANnav servers or managed Fibre Channel switches. The vulnerability is CWE-522 (insufficiently protected credentials) and requires an existing local foothold (CVSS vector AV:L/PR:L, no user interaction), so unauthenticated remote attackers cannot exploit it directly. No public exploit identified at time of analysis.
Remote, unauthenticated attackers can reach insufficiently protected credentials in Cisco License On-Prem (formerly Cisco Smart Software Manager On-Prem) and potentially read and modify them, based on Cisco's hardening advisory covering several internally discovered CWE-522 issues tracked under this single CVE. Cisco rates it CVSS 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating a network-reachable, low-complexity flaw requiring no privileges and no user interaction, with high confidentiality and integrity impact but no availability impact. The wildcard CPE cpe:2.3:a:cisco:cisco_license_on-prem:*:*:*:*:*:*:*:* indicates all shipping versions are affected until the vendor's hardening release is applied; no public exploit code or confirmed active exploitation was identified at time of analysis (no CISA KEV listing and no PoC referenced), and practical exposure is constrained because these on-prem appliances normally sit on internal management networks rather than the public internet.
Obot versions 0.12.0 through 0.26.1 return admin- and power-user-supplied static secrets (API keys, tokens) on MCP catalog entries in plaintext to any user who has been granted that entry through Obot's access-control rules, exposing credentials for abuse against backend services. Affected users need a valid Obot account at basic privilege plus an explicit grant on the target entry, and the entry must actually carry admin-set static configuration values, so anonymous exploitation is not possible and only a subset of catalog entries is reachable in practice; the assessed severity is moderate (CVSS 7.1, confidentiality-only impact with no integrity or availability loss). No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing); the vendor has released a fix in Obot v0.26.2.