CVE-2026-62900 | Medium | 5.9 | 2026-08-11 | Improper removal of sensitive information before storage or transfer in .NET allows an unauthorized attacker to disclose information over a network. |
CVE-2024-5300 | Medium | 5.6 | 2026-07-21 | An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstractio… |
CVE-2026-15811 | Medium | 5.8 | 2026-07-21 | A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive m… |
CVE-2026-16104 | Medium | 4.3 | 2026-07-17 | A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identi… |
CVE-2026-45737 | Medium | 6.3 | 2026-07-15 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kuberne… |
CVE-2026-54421 | Medium | 6.8 | 2026-06-14 | In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized for, Ironic can return unredacted sensiti… |
CVE-2026-46657 | High | 7.1 | 2026-06-08 | Bludit is a content management system. Versions prior to 3.22.0 have a vulnerability in the user management logic that allows deactivated accounts to maintain… |
CVE-2026-36178 | Medium | 4.6 | 2026-06-04 | The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configuration partition, possibly allowing att… |
CVE-2026-45046 | Medium | 5.5 | 2026-05-27 | Gryph provides a security layer for AI coding agents. Prior to 0.7.0, Gryph implements logging levels that determine what content is logged to a local sqlite d… |
CVE-2026-27892 | Medium | 6.5 | 2026-05-18 | FacturaScripts is an open source accounting and invoicing software. In versions prior to 2026, the Library module stores and serves uploaded images byte-for-by… |
CVE-2026-42186 | High | 7.5 | 2026-05-14 | OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to… |
CVE-2026-42880 | Critical | 9.6 | 2026-05-07 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11 and 3.3.0 to before 3.3.9, there is a missing au… |
CVE-2024-43384 | High | 8.0 | 2026-05-07 | A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer. |
CVE-2026-43528 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.14 contains a redaction bypass vulnerability that allows authenticated gateway clients to receive unredacted secrets through sourceConfi… |
CVE-2026-43824 | High | 7.7 | 2026-05-02 | In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data. |
CVE-2026-40895 | High | 7.5 | 2026-04-21 | follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HT… |
CVE-2026-20928 | Medium | 4.6 | 2026-04-14 | Improper removal of sensitive information before storage or transfer in Windows Recovery Environment Agent allows an unauthorized attacker to bypass a security… |
CVE-2026-39937 | | | 2026-04-07 | Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resourc… |
CVE-2026-34214 | High | 7.7 | 2026-03-31 | Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (acce… |
CVE-2026-32891 | Critical | 9.0 | 2026-03-20 | Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contai… |
CVE-2026-1182 | Medium | 4.3 | 2026-03-12 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.14 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allow… |
CVE-2026-1732 | Medium | 4.3 | 2026-03-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allow… |
CVE-2026-27640 | High | 7.5 | 2026-02-25 | tfplan2md is software for converting Terraform plan JSON files into human-readable Markdown reports. Prior to version 1.26.1, a bug in tfplan2md affected sever… |
CVE-2025-8860 | Low | 3.3 | 2026-02-18 | A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is… |
CVE-2025-61643 | Medium | 6.1 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/recentchanges/RecentChangeRCFeedNotifier.Php.
Th… |
CVE-2025-59955 | Medium | 5.7 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 h… |
CVE-2025-68131 | High | 7.5 | 2025-12-31 | cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5… |
CVE-2025-61594 | High | 7.5 | 2025-12-30 | URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundl… |
CVE-2025-14267 | Medium | 4.9 | 2025-12-19 | Incomplete removal of sensitive information before transfer vulnerability in M-Files Corporation M-Files Server allows data leak exposure affecting versions be… |
CVE-2025-65000 | Medium | 5.3 | 2025-12-18 | SSH private keys of the "Remote alert handlers (Linux)" rule were exposed in the rule page's HTML source in Checkmk <= 2.4.0p18 and all versions of Checkmk 2.3… |
CVE-2025-65965 | | | 2025-11-25 | Grype is a vulnerability scanner for container images and filesystems. A credential disclosure vulnerability was found in Grype, affecting versions 0.68.0 thro… |
CVE-2025-62483 | Medium | 5.3 | 2025-11-13 | Improper removal of sensitive information in certain Zoom Clients before version 6.5.10 may allow an unauthenticated user to conduct a disclosure of informatio… |
CVE-2025-64326 | Low | 2.6 | 2025-11-06 | Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in t… |
CVE-2025-0011 | Low | 3.3 | 2025-09-06 | Improper removal of sensitive information before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address information potenti… |
CVE-2025-58049 | Medium | 5.8 | 2025-08-28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1… |
CVE-2025-57757 | Medium | 5.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items… |
CVE-2025-1759 | Medium | 5.9 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap m… |
CVE-2025-33013 | Medium | 6.2 | 2025-07-24 | IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0… |
CVE-2025-53886 | Medium | 4.5 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flo… |
CVE-2025-48708 | Medium | 4.0 | 2025-05-23 | gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case. A created PDF document incl… |
CVE-2025-48066 | Medium | 6.0 | 2025-05-22 | wire-webapp is the web application for the open-source messaging service Wire. A bug fix caused a regression causing an issue with function to delete local dat… |
CVE-2025-27221 | Low | 3.2 | 2025-03-04 | In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because u… |
CVE-2025-20118 | Medium | 4.4 | 2025-02-26 | A vulnerability in the implementation of the internal system processes of Cisco APIC could allow an authenticated, local attacker to access sensitive informati… |
CVE-2025-24884 | | | 2025-01-29 | kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real c… |
CVE-2024-8474 | High | 7.5 | 2025-01-06 | OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an unauthoriz… |
CVE-2024-56353 | Medium | 5.5 | 2024-12-20 | In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies |
CVE-2024-41156 | Low | 2.7 | 2024-10-29 | Profile files from TRO600 series radios are extracted in plain-text
and encrypted file formats. Profile files provide potential attackers
valuable configuratio… |
CVE-2024-49997 | High | 7.5 | 2024-10-21 | In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: lantiq_etop: fix memory disclosure
When applying padding, the buffer is no… |
CVE-2024-43554 | Medium | 5.5 | 2024-10-08 | Windows Kernel-Mode Driver Information Disclosure Vulnerability |
CVE-2024-29120 | Medium | 5.9 | 2024-07-17 | In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credentia… |
CVE-2024-6055 | Medium | 4.7 | 2024-06-17 | Improper removal of sensitive information in data source export feature in Devolutions Remote Desktop Manager 2024.1.32.0 and earlier on Windows allows an atta… |
CVE-2024-31493 | Medium | 6.5 | 2024-06-03 | An improper removal of sensitive information before storage or transfer vulnerability [CWE-212] in FortiSOAR version 7.3.0, version 7.2.2 and below, version 7… |
CVE-2024-32036 | Medium | 5.3 | 2024-04-15 | ImageSharp is a 2D graphics API. A data leakage flaw was found in ImageSharp's JPEG and TGA decoders. This vulnerability is triggered when an attacker passes a… |
CVE-2024-32028 | Medium | 4.1 | 2024-04-12 | OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCor… |
CVE-2023-52376 | High | 7.5 | 2024-02-18 | Information management vulnerability in the Gallery module.Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-48308 | Low | 3.5 | 2023-12-22 | Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while… |
CVE-2023-41967 | Low | 2.4 | 2023-12-18 |
Sensitive information uncleared after debug/power state transition in the Controller 6000 could be abused by an attacker with knowledge of the Controller's de… |
CVE-2023-3006 | Medium | 5.5 | 2023-05-31 | A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is… |
CVE-2023-28834 | Low | 3.5 | 2023-04-03 | Nextcloud Server is an open source personal cloud server. Nextcloud Server 24.0.0 until 24.0.6 and 25.0.0 until 25.0.4, as well as Nextcloud Enterprise Server… |
CVE-2023-1637 | Medium | 5.5 | 2023-03-27 | A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management options functional… |
CVE-2022-3460 | High | 7.5 | 2023-01-03 | In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview. |
CVE-2022-4734 | High | 8.1 | 2022-12-27 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.
|
CVE-2022-39393 | High | 8.6 | 2022-11-10 | Wasmtime is a standalone runtime for WebAssembly. Prior to versions 2.0.2 and 1.0.2, there is a bug in Wasmtime's implementation of its pooling instance alloca… |
CVE-2022-0171 | Medium | 5.5 | 2022-08-26 | A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kerne… |
CVE-2022-2818 | Critical | 9.8 | 2022-08-15 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2. |
CVE-2022-31162 | High | 7.5 | 2022-07-22 | Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stri… |
CVE-2022-29900 | Medium | 6.5 | 2022-07-12 | Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain microarchitecture-dependent conditions. |
CVE-2022-33740 | High | 7.1 | 2022-07-05 | Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which… |
CVE-2022-31112 | High | 8.2 | 2022-06-30 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not re… |
CVE-2022-31090 | High | 7.7 | 2022-06-27 | Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is p… |
CVE-2021-46813 | High | 7.5 | 2022-06-13 | Vulnerability of residual files not being deleted after an update in the ChinaDRM module. Successful exploitation of this vulnerability may affect availability. |
CVE-2022-31043 | High | 7.5 | 2022-06-10 | Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a request using the `ht… |
CVE-2022-31042 | High | 7.5 | 2022-06-10 | Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a request using the `https… |
CVE-2022-1893 | Medium | 4.6 | 2022-05-31 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3. |
CVE-2022-30618 | High | 7.5 | 2022-05-19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if cont… |
CVE-2022-30617 | High | 8.8 | 2022-05-19 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel… |
CVE-2021-33082 | Medium | 4.6 | 2022-05-12 | Sensitive information in resource not removed before reuse in firmware for some Intel(R) SSD and Intel(R) Optane(TM) SSD Products may allow an unauthenticated… |
CVE-2021-33080 | Medium | 6.8 | 2022-05-12 | Exposure of sensitive system information due to uncleared debug information in firmware for some Intel(R) SSD DC, Intel(R) Optane(TM) SSD and Intel(R) Optane(T… |
CVE-2022-1650 | High | 8.1 | 2022-05-12 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2. |
CVE-2022-24798 | High | 7.5 | 2022-03-31 | Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. IRRd did not always filter password hashes in… |
CVE-2021-26341 | Medium | 6.5 | 2022-03-11 | Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage. |
CVE-2021-3602 | Medium | 5.5 | 2022-03-03 | An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds (e.g. Dockerfile RU… |
CVE-2022-24719 | Low | 2.6 | 2022-03-01 | Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection str… |
CVE-2022-25187 | Medium | 6.5 | 2022-02-15 | Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle. |
CVE-2022-23633 | High | 7.4 | 2022-02-11 | Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response… |
CVE-2022-22779 | Low | 3.7 | 2022-02-09 | The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving… |
CVE-2022-0536 | Low | 2.6 | 2022-02-09 | Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8. |
CVE-2022-23605 | Medium | 4.4 | 2022-02-04 | Wire webapp is a web client for the wire messaging protocol. In versions prior to 2022-01-27-production.0 expired ephemeral messages were not reliably removed… |
CVE-2022-0355 | High | 8.8 | 2022-01-26 | Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1. |
CVE-2021-39891 | Medium | 5.9 | 2021-10-05 | In all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the end of impersonation… |
CVE-2020-36476 | High | 7.5 | 2021-08-23 | An issue was discovered in Mbed TLS before 2.24.0 (and before 2.16.8 LTS and before 2.7.17 LTS). There is missing zeroization of plaintext buffers in mbedtls_s… |
CVE-2021-38554 | Medium | 5.3 | 2021-08-13 | HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pe… |
CVE-2021-28689 | Medium | 5.5 | 2021-06-11 | x86: Speculative vulnerabilities with bare (non-shim) 32-bit PV guests 32-bit x86 PV guest kernels run in ring 1. At the time when Xen was developed, this area… |
CVE-2021-32658 | Medium | 4.7 | 2021-06-08 | Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not properly clean all s… |
CVE-2020-14301 | Medium | 6.5 | 2021-05-27 | An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML du… |
CVE-2021-31780 | High | 7.5 | 2021-04-23 | In app/Model/MispObject.php in MISP 2.4.141, an incorrect sharing group association could lead to information disclosure on an event edit. When an object has a… |
CVE-2020-11198 | Medium | 6.7 | 2021-02-22 | Key material used for TZ diag buffer encryption and other data related to log buffer is not wiped securely due to improper usage of memset in Snapdragon Auto… |
CVE-2021-0340 | High | 8.8 | 2021-02-10 | In parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information due to improper input validation. This could lead to remote i… |
CVE-2021-3031 | Medium | 4.3 | 2021-01-13 | Padding bytes in Ethernet packets on PA-200, PA-220, PA-500, PA-800, PA-2000 Series, PA-3000 Series, PA-3200 Series, PA-5200 Series, and PA-7000 Series firewal… |
CVE-2020-26965 | Medium | 6.5 | 2020-12-09 | Some websites have a feature "Show Password" where clicking a button will change a password field into a textbook field, revealing the typed password. If, when… |