https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T02:45:52.714391+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-349653 EUVD-2026-349653 2026-10-06T02:45:52.761657+00:00 EUVD-2026-349653 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71260 fkie_cve-2026-71260 2026-10-06T02:45:52.761697+00:00

ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value/set_json_value.

 https://cve.radiocsirt.org/vuln/ghsa-qmjj-2rwx-5ffc GHSA-qmjj-2rwx-5ffc 2026-10-06T02:45:52.761733+00:00

ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_() (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value()/set_json_value(). Because web_server listens on port 80 with no authentication by default, any attacker on the local network can retrieve the plaintext password (e.g. WiFi credentials, API tokens) via GET /text/<entity_id> or the /events EventSource stream.