Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 05:12:15 +0000 CVE-2026-71260 — ESPHome web_server Plaintext Password Disclosure via JSON "value" Field https://cve.radiocsirt.org/vuln/cve-2026-71260 <p><strong>Affected:</strong> esphome</p> <p>ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON &#34;state&#34; field correctly masked as &#34;********&#34;, but the same serialization path unconditionally writes the raw password into the JSON &#34;value&#34; field via set_json_icon_state_value/set_json_value.</p> <p><strong>Affected:</strong> esphome</p> <p>ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON &#34;state&#34; field correctly masked as &#34;********&#34;, but the same serialization path unconditionally writes the raw password into the JSON &#34;value&#34; field via set_json_icon_state_value/set_json_value.</p> https://cve.radiocsirt.org/vuln/cve-2026-71260