CVE-2026-15933
OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously conf
CVSS
—
Sin CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 3 sept 2026 · Última mod.: 3 sept 2026 · CWE-256
Sin historial EPSS suficiente todavía.
OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user list import), and SharePoint credentials, in cleartext via the web administration panel page source, allowing exposure of sensitive third-party authentication data. This issue was fixed in version 26.08
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2021-384898.2 ALT—
———HDD password plaintext is stored in a UEFI variable.15hCVE-2026-824537.5 ALT20.4%
——6rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.6dCVE-2026-557658.5 ALT21.0%
——6CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and appendPasswordOption in internal/management/controller/roles/postgres.go. When pg_stat_statements was preloaded with track_utility enabled and an untrusted tenant held pg_monitor or pg_read_all_stats, the tenant could recover platform-managed superuser or application-owner passwords, reconnect through enabled superuser TCP access, and execute operating system commands in the database pod with `COPY ... FROM PROGRAM`. Clusters using SCRAM-SHA-256 verifiers in managed-role Secrets were not affected. This issue is fixed in versions 1.28.4, 1.29.2, and 1.30.0.10dCVE-2026-551644.9 MED14.2%
——4Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hash_password only for the before_insert event. Because no before_update listener ran, administrator-initiated password changes through PUT /api/1/users/ were committed as plaintext. The affected user could no longer authenticate normally because bcrypt verification received an unhashed value. A database, backup, replica, query-log, or administrative read compromise exposed immediately usable credentials without offline cracking. The fix registers hashing for before_update and avoids rehashing values that already have a bcrypt prefix. This issue is fixed in version 1.9.2.17dCVE-2026-50641—5.5%
——2Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database
This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login.36dCVE-2026-41874—3.1%
——1Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation.
The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
Only version 6.7 was tested but all versions should be considered as vulnerable.36d