https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:32:03 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349653 EUVD-2026-349653 https://cve.radiocsirt.org/vuln/euvd-2026-349653 https://cve.radiocsirt.org/vuln/fkie_cve-2026-71260 <p>ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON &#34;state&#34; field correctly masked as &#34;********&#34;, but the same serialization path unconditionally writes the raw password into the JSON &#34;value&#34; field via set_json_icon_state_value/set_json_value.</p> <p>ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON &#34;state&#34; field correctly masked as &#34;********&#34;, but the same serialization path unconditionally writes the raw password into the JSON &#34;value&#34; field via set_json_icon_state_value/set_json_value.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-71260 https://cve.radiocsirt.org/vuln/ghsa-qmjj-2rwx-5ffc <p>ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_() (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON &#34;state&#34; field correctly masked as &#34;********&#34;, but the same serialization path unconditionally writes the raw password into the JSON &#34;value&#34; field via set_json_icon_state_value()/set_json_value(). Because web_server listens on port 80 with no authentication by default, any attacker on the local network can retrieve the plaintext password (e.g. WiFi credentials, API tokens) via GET /text/&lt;entity_id&gt; or the /events EventSource stream.</p> <p>ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_() (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON &#34;state&#34; field correctly masked as &#34;********&#34;, but the same serialization path unconditionally writes the raw password into the JSON &#34;value&#34; field via set_json_icon_state_value()/set_json_value(). Because web_server listens on port 80 with no authentication by default, any attacker on the local network can retrieve the plaintext password (e.g. WiFi credentials, API tokens) via GET /text/&lt;entity_id&gt; or the /events EventSource stream.</p> https://cve.radiocsirt.org/vuln/ghsa-qmjj-2rwx-5ffc