Monthly
Cleartext transmission of sensitive or security-critical data by IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a network-positioned attacker read that traffic by passively sniffing the communication channel, resulting in high confidentiality loss without any integrity or availability impact. Affected deployments span the 4.0.6.0 release line (including the 4.0.6.0.0.6.0 Refresh, Operator 4.4.6+20260807.081800) through 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 064. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit code has been identified; EPSS is low at 0.20% (10th percentile), and CISA's SSVC assessment records exploitation: none, automatable: no. The practical barrier is the attacker's required vantage point on the traffic path, which our assessment reflects by treating attack complexity as high (AV:N/AC:H/PR:N/UI:N) rather than the vendor-published AC:L, making this a moderate rather than top-tier priority; a vendor patch is available.
Cleartext credential exposure in syslink software AG's Avantra (an SAP/enterprise infrastructure monitoring and automation platform) on Linux and Windows allows a network-positioned attacker to capture authentication credentials by sniffing traffic, because sensitive credentials are transported without adequate encryption in all releases before 25.3.0. Successful interception yields valid credentials that can be replayed against the monitored SAP landscape and Avantra itself. No public exploit identified at time of analysis, and EPSS is very low (0.03%), but SSVC rates the technical impact as total.
Credential disclosure in Mozilla Thunderbird's Exchange AutoDiscover account-setup flow allows an on-path network attacker to capture the user's password when the client falls back to plaintext HTTP and includes the entered credentials in that request. Thunderbird versions prior to 158.0.1 are affected; exploitation is limited to the one-time account-configuration window and requires the attacker to already control the network path (CVSS 5.9, AC:H). No public exploit code was identified at time of analysis.
HCL IntelliOps Event Management (IEM) fails to enforce HTTP Strict Transport Security (HSTS), enabling network-positioned attackers to perform SSL stripping and intercept communications that should be protected by TLS. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates unauthenticated network exploitation but at high attack complexity, meaning the attacker must occupy a man-in-the-middle position on the network path. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing realistic risk in the low-to-moderate range confined to adversarial network environments.
Hardcoded static credentials in Chef 360 prior to v1.7.0 exposed internal message queue infrastructure to unauthorized network access, disclosing tenant-specific identifiers across the multi-tenant platform. The credential was embedded in the product itself, making it accessible to any party with possession of the software. Progress Chef confirmed the issue and eliminated the static credential entirely in v1.7.0 by replacing it with per-tenant access controls. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental vector flags this as automatable (AU:Y) with proof-of-concept exploit maturity (E:P), elevating its realistic urgency beyond the low base score of 2.3.
Kiteworks Secure Data Forms prior to version 9.2.1 contains a misconfiguration of security attributes that allows unprotected transport of credentials over the network. This vulnerability affects all versions below 9.2.1 and enables attackers to intercept sensitive authentication material in transit, potentially leading to account compromise and unauthorized access to the private data network. No active exploitation in the wild (KEV) or public proof-of-concept has been reported, though the CVSS 6.5 score and high confidentiality impact indicate meaningful risk.
Brightpick Mission Control discloses device telemetry, configuration, and credential information via WebSocket traffic to unauthenticated users when they connect to a specific URL. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Credential disclosure in the Brightpick Mission Control web application allows anyone able to retrieve the application's client-side JavaScript bundle to extract hardcoded credentials embedded in that code. Because the secrets ship to the browser, any user or adjacent-network actor who loads the front-end can recover them and potentially authenticate to back-end services in this warehouse-automation/ICS-OT product. Reported by CISA ICS-CERT (ICSA-25-317-04); no public exploit has been identified and EPSS exploitation probability is very low (0.06%, 17th percentile).
Credential interception in the Webfrontend allows an unauthenticated man-in-the-middle attacker to capture login credentials from websocket traffic, potentially enabling account takeover of the affected web interface. Exploitation requires the attacker to hold a network interception position and a legitimate user to log in during that window; the CVSS 3.1 score is 6.8 with high attack complexity and user interaction. No public exploit identified at time of analysis, and EPSS is 0.46% (39th percentile).
Audiobookshelf is an open-source self-hosted audiobook server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cleartext transmission of sensitive or security-critical data by IBM Financial Transaction Manager (FTM) for Red Hat OpenShift lets a network-positioned attacker read that traffic by passively sniffing the communication channel, resulting in high confidentiality loss without any integrity or availability impact. Affected deployments span the 4.0.6.0 release line (including the 4.0.6.0.0.6.0 Refresh, Operator 4.4.6+20260807.081800) through 4.0.7.0, 4.0.8.0, 4.0.9.0 and 4.0.10.0 Interim Fix 064. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit code has been identified; EPSS is low at 0.20% (10th percentile), and CISA's SSVC assessment records exploitation: none, automatable: no. The practical barrier is the attacker's required vantage point on the traffic path, which our assessment reflects by treating attack complexity as high (AV:N/AC:H/PR:N/UI:N) rather than the vendor-published AC:L, making this a moderate rather than top-tier priority; a vendor patch is available.
Cleartext credential exposure in syslink software AG's Avantra (an SAP/enterprise infrastructure monitoring and automation platform) on Linux and Windows allows a network-positioned attacker to capture authentication credentials by sniffing traffic, because sensitive credentials are transported without adequate encryption in all releases before 25.3.0. Successful interception yields valid credentials that can be replayed against the monitored SAP landscape and Avantra itself. No public exploit identified at time of analysis, and EPSS is very low (0.03%), but SSVC rates the technical impact as total.
Credential disclosure in Mozilla Thunderbird's Exchange AutoDiscover account-setup flow allows an on-path network attacker to capture the user's password when the client falls back to plaintext HTTP and includes the entered credentials in that request. Thunderbird versions prior to 158.0.1 are affected; exploitation is limited to the one-time account-configuration window and requires the attacker to already control the network path (CVSS 5.9, AC:H). No public exploit code was identified at time of analysis.
HCL IntelliOps Event Management (IEM) fails to enforce HTTP Strict Transport Security (HSTS), enabling network-positioned attackers to perform SSL stripping and intercept communications that should be protected by TLS. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates unauthenticated network exploitation but at high attack complexity, meaning the attacker must occupy a man-in-the-middle position on the network path. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing realistic risk in the low-to-moderate range confined to adversarial network environments.
Hardcoded static credentials in Chef 360 prior to v1.7.0 exposed internal message queue infrastructure to unauthorized network access, disclosing tenant-specific identifiers across the multi-tenant platform. The credential was embedded in the product itself, making it accessible to any party with possession of the software. Progress Chef confirmed the issue and eliminated the static credential entirely in v1.7.0 by replacing it with per-tenant access controls. No public exploit identified at time of analysis, though the CVSS 4.0 supplemental vector flags this as automatable (AU:Y) with proof-of-concept exploit maturity (E:P), elevating its realistic urgency beyond the low base score of 2.3.
Kiteworks Secure Data Forms prior to version 9.2.1 contains a misconfiguration of security attributes that allows unprotected transport of credentials over the network. This vulnerability affects all versions below 9.2.1 and enables attackers to intercept sensitive authentication material in transit, potentially leading to account compromise and unauthorized access to the private data network. No active exploitation in the wild (KEV) or public proof-of-concept has been reported, though the CVSS 6.5 score and high confidentiality impact indicate meaningful risk.
Brightpick Mission Control discloses device telemetry, configuration, and credential information via WebSocket traffic to unauthenticated users when they connect to a specific URL. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Credential disclosure in the Brightpick Mission Control web application allows anyone able to retrieve the application's client-side JavaScript bundle to extract hardcoded credentials embedded in that code. Because the secrets ship to the browser, any user or adjacent-network actor who loads the front-end can recover them and potentially authenticate to back-end services in this warehouse-automation/ICS-OT product. Reported by CISA ICS-CERT (ICSA-25-317-04); no public exploit has been identified and EPSS exploitation probability is very low (0.06%, 17th percentile).
Credential interception in the Webfrontend allows an unauthenticated man-in-the-middle attacker to capture login credentials from websocket traffic, potentially enabling account takeover of the affected web interface. Exploitation requires the attacker to hold a network interception position and a legitimate user to log in during that window; the CVSS 3.1 score is 6.8 with high attack complexity and user interaction. No public exploit identified at time of analysis, and EPSS is 0.46% (39th percentile).
Audiobookshelf is an open-source self-hosted audiobook server. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.