CVE-2026-50641

HighCVSS 7.1/10Last modified Oct 23, 2026

Description

Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database

This issue was fixed in version 6.8.0.0, users were also requested to change their password on the first login.

Metrics

CVSS 4.0 7.1/10CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-256

Affected software

No affected versions have been published.

Timeline

Published
Jul 29, 2026
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-506424.8diff‑so‑fancy does not properly sanitize non‑SGR terminal control sequences before outputting diff data. The application only strips ANSI SGCVE-2026-506435.18cc is vulnerable to an Out‑of‑Bounds Read due to improper handling of #line directives and GNU linemarkers. The compiler accepts attacker-cCVE-2026-506448.6SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL comCVE-2026-506457.5There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can leadCVE-2026-506467.8Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally.CVE-2026-506477.5Loop with unreachable exit condition ('infinite loop') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deCVE-2026-506487.5Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network.CVE-2026-506497.8Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally.CVE-2026-50658.8IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses foCVE-2026-506507.8Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally.CVE-2026-506517.5Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-506527.5Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.
CVE-2026-50641: High severity, CVSS 7.1 | Vulnix