CVE-2026-14867
Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker
CVSS
5.5
Medium
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Published: Jul 7, 2026 · Last modified: Jul 9, 2026 · CWE-256
0.1%EPSS · 30 days0.1%
2026-08-042026-08-31
Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials. Active Directory accounts are not affected by this vulnerability.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-824537.5 HIG20.4%
——6rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.4dCVE-2026-557658.5 HIG20.9%
——6CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements was preloaded with track_utility enabled and an untrusted tenant held pg_monitor or pg_read_all_stats, the tenant could recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute operating system commands in the database pod with `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.7dCVE-2026-551644.9 MED14.2%
——4Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hash_password only for the before_insert event. Because no before_update listener ran, administrator-initiated password changes through PUT /api/1/users/ were committed as plaintext. The affected user could no longer authenticate normally because bcrypt verification received an unhashed value. A database, backup, replica, query-log, or administrative read compromise exposed immediately usable credentials without offline cracking. The fix registers hashing for before_update and avoids rehashing values that already have a bcrypt prefix. This issue is fixed in version 1.9.2.14dCVE-2026-50641—5.5%
——2Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database
This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login.33dCVE-2026-41874—3.1%
——1Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation.
The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Only version 6.7 was tested but all versions should be considered as vulnerable.33dCVE-2026-618866.5 MED14.7%
——4Weintek cMT3092X HMI stores user account passwords in plaintext.34d