Monthly
Cleartext database password disclosure in MariaDB Connector/J (all versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows an active network man-in-the-middle to capture a victim application's full database password during the initial TLS handshake. The connector's initial-handshake code path transmits a mysql_clear_password authentication response before validating the certificate fingerprint that is supposed to enforce server identity - a guard that the OK-packet and auth-switch paths correctly enforce but that HandshakeResponse.encode() bypasses entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the vulnerability mechanism is fully documented in a vendor-published HackerOne report and GHSA advisory.
Credential disclosure in AUTOMATIC1111 Stable Diffusion WebUI through version 1.10.1 exposes configured authentication credentials to unauthenticated network attackers via the `/sdapi/v1/cmd-flags` REST endpoint. The endpoint serializes all runtime command-line arguments - including `gradio_auth` and `api_auth` values - into a cleartext JSON response with no access control, directly nullifying the authentication protection those flags are meant to provide. No public exploit or active exploitation has been confirmed, but the attack path is a single unauthenticated HTTP request to a known endpoint, making this a high-priority finding for any publicly reachable deployment.
Credential theft in gitoxide's curl-based HTTP transport backend allows attackers to capture authentication tokens (passwords, OAuth tokens) by exploiting a URL validation flaw during HTTP redirects. Affected are gitoxide versions 0.25.4 through 0.55.0 using the curl backend; the reqwest backend implements correct cross-domain redirect blocking and is not affected. An attacker who controls or can influence a redirect response from a git server can cause gitoxide to send the victim's full credentials to an attacker-controlled host on subsequent POST requests. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Credential exfiltration in gitoxide's gix-transport crate allows a server controlling an HTTP redirect response to steal the caller's HTTP Basic Authorization credentials by exploiting a hand-rolled URL parser in gix-url that misidentifies the authority component of crafted redirect URLs. Affected are gix-url versions ≤ 0.32.0 and gix-transport versions ≤ 0.49.0; the redirect identity guard `can_reuse_identity` fails open when the parser does not treat '?' or '#' as authority terminators per RFC 3986, causing credentials to be forwarded to an unintended host. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 8.7 reflects a full confidentiality impact with no authentication prerequisites.
Plaintext administrative credential exposure in the Ebyte NE2-D11 firmware management interface allows anyone with physical access to directly observe device credentials without any authentication or tooling. Reported by ICS-CERT under advisory ICSA-26-237-06, the flaw (CWE-522) affects all known firmware versions per CPE data, with a physical attack vector (AV:P) confirming that exploitation requires proximity to the device. Credential capture could enable full administrative control over the device, with downstream risk to industrial operations where the NE2-D11 is deployed. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
NTLM credential capture in Veeam ONE exposes the Reporter service account to any low-privileged authenticated user over the network, enabling theft of service account credentials without user interaction. The captured Net-NTLMv2 hash can be relayed or cracked offline to compromise other systems in the environment, reflected by the high subsequent-system impact scores (SC:H/SI:H/SA:H) in the CVSS 4.0 vector. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the attack technique is well-understood and Veeam backup infrastructure is a high-value ransomware target.
Credential exposure in Rently Smart Home versions 20.1.0 and prior allows authenticated network-based attackers to retrieve all property access PINs, including the Master Pin that overrides the standard user permission hierarchy. Reported by ICS-CERT via CISA advisory ICSA-26-237-01, the flaw is particularly severe in property rental contexts where Master Pin retrieval translates directly to unauthorized physical access to tenant properties. No public exploit code has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a genuine operational and physical security risk.
Credential exposure in NVIDIA NemoClaw allows a local low-privileged user, upon triggering user interaction, to access insufficiently protected credential material stored or accessible within the application's runtime context. The CVSS 5.6 Medium score reflects the constrained local attack vector (AV:L), but the high confidentiality impact (C:H) indicates that successfully harvested credentials could enable meaningful lateral movement or downstream access beyond the initial system. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.
Information disclosure in Grav CMS before 2.0.16 enables authenticated users holding page-edit permission to retrieve sensitive system configuration values - including Redis passwords and other stored credentials - by invoking `config.get()` or `config.toArray()` within Twig templates. The root cause is an incomplete default denylist in the Twig sandbox configuration that fails to block access to the `config` object when the `config_access` feature is enabled. No public exploit has been identified and the vulnerability is not confirmed actively exploited at time of analysis.
Credential extraction in Grav CMS before 2.0.16 allows authenticated users with page-edit permissions to read hashed passwords and two-factor authentication secrets from User objects via insufficiently filtered Twig template sandbox methods. The allow-listed offsetGet() and offsetExists() methods on User objects expose sensitive fields that should be restricted within the sandboxed template context, enabling offline password cracking and subsequent authentication bypass. No public exploit has been identified at time of analysis, but the exploit technique is straightforward for any attacker holding page-edit rights.
Cleartext database password disclosure in MariaDB Connector/J (all versions before 2.7.14, 3.3.5, 3.4.3, and 3.5.9) allows an active network man-in-the-middle to capture a victim application's full database password during the initial TLS handshake. The connector's initial-handshake code path transmits a mysql_clear_password authentication response before validating the certificate fingerprint that is supposed to enforce server identity - a guard that the OK-packet and auth-switch paths correctly enforce but that HandshakeResponse.encode() bypasses entirely. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the vulnerability mechanism is fully documented in a vendor-published HackerOne report and GHSA advisory.
Credential disclosure in AUTOMATIC1111 Stable Diffusion WebUI through version 1.10.1 exposes configured authentication credentials to unauthenticated network attackers via the `/sdapi/v1/cmd-flags` REST endpoint. The endpoint serializes all runtime command-line arguments - including `gradio_auth` and `api_auth` values - into a cleartext JSON response with no access control, directly nullifying the authentication protection those flags are meant to provide. No public exploit or active exploitation has been confirmed, but the attack path is a single unauthenticated HTTP request to a known endpoint, making this a high-priority finding for any publicly reachable deployment.
Credential theft in gitoxide's curl-based HTTP transport backend allows attackers to capture authentication tokens (passwords, OAuth tokens) by exploiting a URL validation flaw during HTTP redirects. Affected are gitoxide versions 0.25.4 through 0.55.0 using the curl backend; the reqwest backend implements correct cross-domain redirect blocking and is not affected. An attacker who controls or can influence a redirect response from a git server can cause gitoxide to send the victim's full credentials to an attacker-controlled host on subsequent POST requests. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Credential exfiltration in gitoxide's gix-transport crate allows a server controlling an HTTP redirect response to steal the caller's HTTP Basic Authorization credentials by exploiting a hand-rolled URL parser in gix-url that misidentifies the authority component of crafted redirect URLs. Affected are gix-url versions ≤ 0.32.0 and gix-transport versions ≤ 0.49.0; the redirect identity guard `can_reuse_identity` fails open when the parser does not treat '?' or '#' as authority terminators per RFC 3986, causing credentials to be forwarded to an unintended host. No public exploit has been identified at time of analysis, though the CVSS 4.0 score of 8.7 reflects a full confidentiality impact with no authentication prerequisites.
Plaintext administrative credential exposure in the Ebyte NE2-D11 firmware management interface allows anyone with physical access to directly observe device credentials without any authentication or tooling. Reported by ICS-CERT under advisory ICSA-26-237-06, the flaw (CWE-522) affects all known firmware versions per CPE data, with a physical attack vector (AV:P) confirming that exploitation requires proximity to the device. Credential capture could enable full administrative control over the device, with downstream risk to industrial operations where the NE2-D11 is deployed. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
NTLM credential capture in Veeam ONE exposes the Reporter service account to any low-privileged authenticated user over the network, enabling theft of service account credentials without user interaction. The captured Net-NTLMv2 hash can be relayed or cracked offline to compromise other systems in the environment, reflected by the high subsequent-system impact scores (SC:H/SI:H/SA:H) in the CVSS 4.0 vector. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the attack technique is well-understood and Veeam backup infrastructure is a high-value ransomware target.
Credential exposure in Rently Smart Home versions 20.1.0 and prior allows authenticated network-based attackers to retrieve all property access PINs, including the Master Pin that overrides the standard user permission hierarchy. Reported by ICS-CERT via CISA advisory ICSA-26-237-01, the flaw is particularly severe in property rental contexts where Master Pin retrieval translates directly to unauthorized physical access to tenant properties. No public exploit code has been identified at time of analysis, but the low attack complexity and network-accessible vector make this a genuine operational and physical security risk.
Credential exposure in NVIDIA NemoClaw allows a local low-privileged user, upon triggering user interaction, to access insufficiently protected credential material stored or accessible within the application's runtime context. The CVSS 5.6 Medium score reflects the constrained local attack vector (AV:L), but the high confidentiality impact (C:H) indicates that successfully harvested credentials could enable meaningful lateral movement or downstream access beyond the initial system. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.
Information disclosure in Grav CMS before 2.0.16 enables authenticated users holding page-edit permission to retrieve sensitive system configuration values - including Redis passwords and other stored credentials - by invoking `config.get()` or `config.toArray()` within Twig templates. The root cause is an incomplete default denylist in the Twig sandbox configuration that fails to block access to the `config` object when the `config_access` feature is enabled. No public exploit has been identified and the vulnerability is not confirmed actively exploited at time of analysis.
Credential extraction in Grav CMS before 2.0.16 allows authenticated users with page-edit permissions to read hashed passwords and two-factor authentication secrets from User objects via insufficiently filtered Twig template sandbox methods. The allow-listed offsetGet() and offsetExists() methods on User objects expose sensitive fields that should be restricted within the sandboxed template context, enabling offline password cracking and subsequent authentication bypass. No public exploit has been identified at time of analysis, but the exploit technique is straightforward for any attacker holding page-edit rights.