Skip to content
Threat Feed
Subscribe

Tag

Plaintext

2 briefs RSS
high advisory

Nebula-Mesh Stores Operator Session Tokens in Plaintext, Enabling Session Hijacking (CVE-2026-53603)

Operator session tokens in ForgeKeep's nebula-mesh application are stored in plaintext within the database, allowing an attacker who gains read access to the database to retrieve active session tokens and hijack operator sessions, bypassing further authentication.

nebula-mesh vulnerability session-hijacking database plaintext credential-exposure
1t
high advisory

Deno TLS Plaintext Injection Vulnerability

A vulnerability in Deno's Node.js tls compatibility layer (versions 2.0.0 to 2.7.7) allows a network attacker to intercept and tamper with plaintext application data transmitted over a supposedly TLS-protected connection when `autoSelectFamily` is enabled and the initial connection attempt fails, leading to potential information disclosure and data manipulation.

deno tls plaintext vulnerability
2r 1t