Total
1488 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-23927 | 2026-06-17 | N/A | N/A | ||
| A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session. | |||||
| CVE-2026-23742 | 1 Zalando | 1 Skipper | 2026-06-17 | N/A | 8.8 HIGH |
| Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem starts if untrusted users can create lua filters, because of -lua-sources=inline , for example through a Kubernetes Ingress resource. The configuration inline allows these user to create a script that is able to read the filesystem accessible to the skipper process and if the user has access to read the logs, they an read skipper secrets. This vulnerability is fixed in 0.23.0. | |||||
| CVE-2026-23658 | 1 Microsoft | 1 Azure Devops | 2026-06-17 | N/A | 8.6 HIGH |
| Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. | |||||
| CVE-2026-22911 | 1 Sick | 2 Tdc-x401gl, Tdc-x401gl Firmware | 2026-06-17 | N/A | 5.3 MEDIUM |
| Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access to the device. | |||||
| CVE-2026-22890 | 1 Ev2go | 1 Ev2go.io | 2026-06-17 | N/A | 6.5 MEDIUM |
| Charging station authentication identifiers are publicly accessible via web-based mapping platforms. | |||||
| CVE-2026-22878 | 1 Mobility46 | 1 Mobility46.se | 2026-06-17 | N/A | 6.5 MEDIUM |
| Charging station authentication identifiers are publicly accessible via web-based mapping platforms. | |||||
| CVE-2026-22576 | 1 Fortinet | 1 Fortisoar | 2026-06-17 | N/A | 4.3 MEDIUM |
| A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve passwords for multiple installed connectors via server address modification in connector configuration. | |||||
| CVE-2026-22574 | 1 Fortinet | 1 Fortisoar | 2026-06-17 | N/A | 4.1 MEDIUM |
| A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.4, FortiSOAR on-premise 7.5.0 through 7.5.2, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow an authenticated remote attacker to retrieve Service account password via server address modification in LDAP configuration. | |||||
| CVE-2026-22240 | 1 Blusparkglobal | 1 Bluvoyix | 2026-06-17 | N/A | 7.5 HIGH |
| The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable users API to retrieve the plaintext passwords of all user users. Successful exploitation of this vulnerability could allow the attacker to gain full access to customers' data and completely compromise the targeted platform by logging in using an exposed admin email address and password. | |||||
| CVE-2026-22043 | 1 Rustfs | 1 Rustfs | 2026-06-17 | N/A | 9.8 CRITICAL |
| RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IAM allows a restricted service account or STS credential to self-issue an unrestricted service account, inheriting the parent’s full privileges. This enables privilege escalation and bypass of session/inline policy restrictions. Version 1.0.0-alpha.79 fixes the issue. | |||||
| CVE-2026-21852 | 1 Anthropic | 1 Claude Code | 2026-06-17 | N/A | 7.5 HIGH |
| Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and when the repository was opened, Claude Code would read the configuration and immediately issue API requests before showing the trust prompt, potentially leaking the user's API keys. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.0.65, which contains a patch, or to the latest version. | |||||
| CVE-2026-21670 | 1 Veeam | 1 Veeam Backup \& Replication | 2026-06-17 | N/A | 7.7 HIGH |
| A vulnerability allowing a low-privileged user to extract saved SSH credentials. | |||||
| CVE-2026-20791 | 1 Chargemap | 1 Chargemap.com | 2026-06-17 | N/A | 6.5 MEDIUM |
| Charging station authentication identifiers are publicly accessible via web-based mapping platforms. | |||||
| CVE-2026-20733 | 1 Cloudcharge | 1 Cloudcharge.se | 2026-06-17 | N/A | 6.5 MEDIUM |
| Charging station authentication identifiers are publicly accessible via web-based mapping platforms. | |||||
| CVE-2026-20435 | 6 Google, Linuxfoundation, Mediatek and 3 more | 40 Android, Yocto, Mt2737 and 37 more | 2026-06-17 | N/A | 4.6 MEDIUM |
| In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10607099; Issue ID: MSV-6118. | |||||
| CVE-2026-1966 | 2026-06-17 | N/A | N/A | ||
| YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration view could obtain LDAP credentials, potentially enabling unauthorized access to external directory services. | |||||
| CVE-2026-1223 | 2026-06-17 | N/A | 4.9 MEDIUM | ||
| PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to allowing authenticated remote attackers to obtain SMTP plaintext passwords through the web frontend. | |||||
| CVE-2026-0715 | 1 Moxa | 70 Uc-1222a, Uc-1222a Firmware, Uc-2222a-t and 67 more | 2026-06-17 | N/A | 6.8 MEDIUM |
| Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physical access to the device could use this information to access the bootloader menu via a serial interface. Access to the bootloader menu does not allow full system takeover or privilege escalation. The bootloader enforces digital signature verification and only permits flashing of Moxa-signed images. As a result, an attacker cannot install malicious firmware or execute arbitrary code. The primary impact is limited to a potential temporary denial-of-service condition if a valid image is reflashed. Remote exploitation is not possible. | |||||
| CVE-2026-0689 | 1 Extremenetworks | 1 Extremecloud Iq Site Engine | 2026-06-17 | N/A | 4.9 MEDIUM |
| In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retrieve masked sensitive parameters from HTTP responses. Although credentials appear redacted in the user interface, the application returns the underlying credential values in the HTTP response, enabling an authorized administrator to recover stored secrets that may exceed their intended access. We would like to thank the Lockheed Martin Red Team for responsibly reporting this issue and working with us through coordinated disclosure. | |||||
| CVE-2025-9521 | 1 Tp-link | 1 Omada Controller | 2026-06-17 | N/A | 6.5 MEDIUM |
| Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypass secondary verification, and change the user’s password without proper confirmation, leading to weakened account security. | |||||