Loading story…
CERT Polska disclosed CVE-2026-50641, a plaintext password storage vulnerability in Streamsoft Business Intelligence that caused user passwords to be stored unprotected in the product database. The issue, classified as CWE-256, affects all versions prior to 6.8.0.0 and exposes credentials to anyone able to access the underlying database.
Streamsoft remediated the flaw in version 6.8.0.0 following coordinated disclosure with CERT Polska. After applying the update, users are required to change their password at first login, a step intended to reduce the risk from credentials that may have been previously stored in plaintext.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-01, CERT Polska published details of CVE-2026-50641, describing it as a plaintext password storage vulnerability in Streamsoft Business Intelligence. The advisory states the issue corresponds to CWE-256 and affects all versions before 6.8.0.0.
Streamsoft remediated the plaintext password storage vulnerability in Streamsoft Business Intelligence with release 6.8.0.0. After the fix, users were required to change their password at first login.
CERT Polska reported that it received a vulnerability report for CVE-2026-50641, a plaintext password storage issue in Streamsoft Business Intelligence. The flaw affects versions earlier than 6.8.0.0 and allows user passwords to be stored in plaintext in the database.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, tracked as CVE-2025-54947, was discovered in Apache StreamPark, a widely used stream-processing platform. The flaw arises from the use of a hard-coded encryption key and insecure AES ECB mode, allowing attackers to decrypt sensitive data, forge authentication tokens, and potentially gain unauthorized access to affected systems. The vulnerability impacts versions 2.0.0 through 2.1.7, exposing organizations to significant risks of information disclosure and privilege escalation if left unpatched. The Apache StreamPark development team has addressed the issue by releasing version 2.1.7, which eliminates the hard-coded key vulnerability. Security experts strongly advise organizations to upgrade to the latest version immediately and conduct thorough security audits of their StreamPark deployments to identify and mitigate any potential compromise resulting from this flaw. Failure to patch could allow threat actors to manipulate system behavior or escalate privileges within enterprise environments relying on StreamPark for real-time data processing.
Jun 29, 2026
CERT Polska disclosed **CVE-2026-15933**, a plaintext-password-storage flaw in OptimiDoc Server (On-Premise) releases before version 26.08. An authenticated administrator can view previously configured external-service credentials in cleartext through the web administration panel's page source. The exposed secrets may include credentials for SMTP, FTP scan delivery, Active Directory user-list imports, and SharePoint. OptimiDoc remediated the issue in version **26.08** following coordinated disclosure with CERT Polska; organizations running earlier releases should upgrade and rotate any credentials configured in the platform.
Sep 3, 2026
Sparx Systems Pro Cloud Server was assigned two high-severity vulnerabilities affecting authentication and database security. **CVE-2025-15624** describes a plaintext password storage issue that occurs when OpenID is used as the primary authentication method for Sparx EA, causing Pro Cloud Server to generate local user passwords and store them in plaintext. The flaw is mapped to `CWE-256` and was scored with a CVSS v4.0 vector indicating network exposure, low attack complexity, no privileges required, and high confidentiality and integrity impact. A second issue, **CVE-2025-15625**, allows an unauthenticated attacker to execute arbitrary SQL queries against the Pro Cloud Server database in certain cases. The vulnerability is mapped to `CWE-89` and `CWE-200`, and its CVSS v4.0 vector indicates remote exploitation without privileges or user interaction, though with high attack complexity. Both CVEs reference Sparx Systems Pro Cloud Server `6.1` history information, linking the disclosures to vendor-documented product changes and fixes.
Jun 29, 2026