CVE-2026-50641 | | | 2026-07-29 | Streamsoft Business Intelligence (BI) stores users' passwords in plaintext form in the database
This issue was fixed in version 6.8.0.0, users were also reque… |
CVE-2026-41874 | | | 2026-07-28 | Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve… |
CVE-2026-61886 | Medium | 6.5 | 2026-07-24 | Weintek cMT3092X HMI stores user account passwords in plaintext. |
CVE-2026-40430 | High | 7.5 | 2026-07-23 | Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API. |
CVE-2026-44187 | Low | 3.3 | 2026-07-22 | A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or mal… |
CVE-2026-46513 | High | 7.4 | 2026-07-16 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bi… |
CVE-2026-14867 | Medium | 5.5 | 2026-07-07 | Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve user… |
CVE-2026-57302 | Medium | 4.3 | 2026-06-24 | Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with… |
CVE-2026-50268 | Low | 1.9 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encrypti… |
CVE-2024-39575 | High | 7.4 | 2026-06-16 | update_disk_psu_baseline.sh requires password in plain text |
CVE-2024-45636 | Medium | 4.1 | 2026-06-11 | IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user. |
CVE-2026-36174 | Medium | 4.6 | 2026-06-04 | GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial console. This issue allows… |
CVE-2018-25396 | High | 7.5 | 2026-05-29 | Heatmiser Wifi Thermostat 1.7 contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve administrative credentials by ac… |
CVE-2026-42151 | High | 7.5 | 2026-05-04 | Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote wri… |
CVE-2026-6500 | | | 2026-05-04 | Plaintext storage of a password vulnerability in ILM Informatique OpenConcerto allows Retrieve Embedded Sensitive Data.
This issue affects OpenConcerto: 1.7.5. |
CVE-2025-36335 | Medium | 6.2 | 2026-04-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.3.0, 5.3.1 stores user credentials in plain text which can be read by a local user. |
CVE-2026-6597 | Low | 2.7 | 2026-04-20 | A weakness has been identified in langflow-ai langflow up to 1.8.3. Impacted is the function remove_api_keys/has_api_terms of the file src/backend/base/langflo… |
CVE-2025-15624 | High | 7.5 | 2026-04-17 | Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server.
In a setup where OpenID is used as the primary method of authe… |
CVE-2021-47961 | High | 8.1 | 2026-04-10 | A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code… |
CVE-2026-35556 | High | 7.5 | 2026-04-09 | OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive informati… |
CVE-2025-36258 | High | 7.1 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 product stores user credentials and other sensitive information in plain text which can be read by… |
CVE-2026-33216 | High | 8.6 | 2026-03-25 | NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments usin… |
CVE-2026-31850 | Medium | 4.9 | 2026-03-23 | Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 stores sensitive information, including administrative credentials and WiFi pre-shared keys, i… |
CVE-2026-4251 | Low | 2.5 | 2026-03-16 | A vulnerability was determined in CityData CityChat up to 0.12.6 on Android. Affected by this vulnerability is an unknown functionality of the file resources/a… |
CVE-2026-4250 | Low | 2.5 | 2026-03-16 | A vulnerability was found in Albert Sağlık Hizmetleri ve Ticaret Albert Health up to 1.7.3 on Android. Affected is an unknown function of the file resources/as… |
CVE-2026-4243 | Low | 2.5 | 2026-03-16 | A weakness has been identified in La Nacion App 10.2.25 on Android. This impacts an unknown function of the file source/app/lanacion/clublanacion/BuildConfig.j… |
CVE-2026-4242 | Low | 2.5 | 2026-03-16 | A security flaw has been discovered in BabyChakra Pregnancy & Parenting App up to 5.4.3.0 on Android. This affects an unknown function of the file file app/bab… |
CVE-2026-4217 | Low | 2.5 | 2026-03-16 | A security vulnerability has been detected in XREAL Nebula App up to 3.2.1 on Android. This impacts an unknown function of the file in ai/nreal/nebula/flutterP… |
CVE-2026-22285 | Medium | 4.4 | 2026-03-04 | Dell Device Management Agent (DDMA), versions prior to 26.02, contain a Plaintext Storage of Password vulnerability. A high privileged attacker with local acce… |
CVE-2024-55026 | Critical | 9.8 | 2026-03-03 | An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrary commands via supp… |
CVE-2026-28360 | Medium | 5.3 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored in plaintext in the database and compare… |
CVE-2026-21660 | Critical | 9.8 | 2026-02-27 | Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22… |
CVE-2025-36425 | Medium | 5.3 | 2026-02-17 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3 could allow an authenticated user to obtain s… |
CVE-2026-23797 | Medium | 4.9 | 2026-02-05 | In Quick.Cart user passwords are stored in plaintext form. An attacker with high privileges can display users' password in user editing page.
The vendor was n… |
CVE-2020-37115 | Medium | 6.5 | 2026-02-03 | GUnet OpenEclass 1.7.3 stores user credentials in plaintext, allowing administrators to view all registered users' usernames and passwords without encryption… |
CVE-2025-12680 | Medium | 4.9 | 2026-02-02 | Brocade SANnav before Brocade SANnav 2.4.0b logs database passwords in clear text in the standby SANnav server, after disaster recovery failover. The vulnerab… |
CVE-2026-21417 | High | 7.0 | 2026-01-27 | Dell CloudBoost Virtual Appliance, versions prior to 19.14.0.0, contains a Plaintext Storage of Password vulnerability. A high privileged attacker with remote… |
CVE-2025-25051 | Medium | 6.1 | 2026-01-22 | An attacker could decrypt sensitive data, impersonate legitimate users
or devices, and potentially gain access to network resources for lateral
attacks. |
CVE-2025-15113 | Critical | 9.3 | 2025-12-30 | Ksenia Security lares (legacy model) Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload M… |
CVE-2025-15128 | Medium | 5.3 | 2025-12-28 | A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint… |
CVE-2018-25130 | Medium | 6.2 | 2025-12-24 | Beward Intercom 2.3.1 contains a credentials disclosure vulnerability that allows local attackers to access plain-text authentication credentials stored in an… |
CVE-2025-66910 | Medium | 6.0 | 2025-12-19 | Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService… |
CVE-2025-65009 | | | 2025-12-18 | In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) admin password is stored in configuration file as plaintext and can be obtained by unauthoriz… |
CVE-2024-42197 | Medium | 5.5 | 2025-12-11 | HCL Workload Scheduler stores user credentials in plain text which can be read by a local user. |
CVE-2025-14183 | Medium | 4.3 | 2025-12-07 | A vulnerability was found in SGAI Space1 NAS N1211DS up to 1.0.915. This issue affects the function GET_FACTORY_INFO/GET_USER_INFO of the file /cgi-bin/JSONAPI… |
CVE-2025-56527 | High | 7.5 | 2025-11-18 | Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage. |
CVE-2025-13221 | Medium | 5.3 | 2025-11-15 | A weakness has been identified in Intelbras UnniTI 24.07.11. The affected element is an unknown function of the file /xml/sistema/usuarios.xml. Executing manip… |
CVE-2025-13187 | Medium | 5.3 | 2025-11-14 | A security vulnerability has been detected in Intelbras ICIP 2.0.20. Affected is an unknown function of the file /xml/sistema/acessodeusuario.xml. Such manipul… |
CVE-2025-9982 | High | 7.5 | 2025-11-14 | A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This flaw allow… |
CVE-2025-46366 | Medium | 6.7 | 2025-11-05 | Dell CloudLink, versions prior to 8.1.1, contain a vulnerability where a privileged user may exploit and gain parallel privilege escalation or access to the da… |
CVE-2025-11193 | Medium | 5.5 | 2025-11-03 | A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to sensitive device spe… |
CVE-2025-36002 | Medium | 5.5 | 2025-10-16 | IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5, and 6.2.1.0 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5, and 6.2.1.0 stores user credentials in… |
CVE-2025-61680 | | | 2025-10-03 | Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.6 stores passwords using VS Code's conf… |
CVE-2025-34210 | Medium | 5.5 | 2025-10-02 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store a large number of sensitive credentials (database passw… |
CVE-2025-43938 | Medium | 5.0 | 2025-09-10 | Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with… |
CVE-2025-46809 | Medium | 5.7 | 2025-07-31 | A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/… |
CVE-2025-45702 | Medium | 6.5 | 2025-07-24 | SoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in plaintext. |
CVE-2025-52164 | High | 8.2 | 2025-07-18 | Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext. |
CVE-2025-7357 | | | 2025-07-16 | LITEON IC48A firmware versions prior to 01.00.19r and LITEON IC80A firmware versions prior to 01.01.12e store FTP-server-access-credentials in cleartext in the… |
CVE-2025-53677 | Medium | 5.3 | 2025-07-09 | Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to obser… |
CVE-2025-53675 | Medium | 6.5 | 2025-07-09 | Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by us… |
CVE-2025-53674 | Medium | 5.3 | 2025-07-09 | Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, increasing the potent… |
CVE-2025-53671 | Medium | 6.5 | 2025-07-09 | Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, inc… |
CVE-2025-53669 | Medium | 4.3 | 2025-07-09 | Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to obs… |
CVE-2025-53665 | Medium | 4.3 | 2025-07-09 | Jenkins Apica Loadtest Plugin 1.10 and earlier does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration form, increasing the p… |
CVE-2025-53664 | Medium | 6.5 | 2025-07-09 | Jenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the Jenkins controller, w… |
CVE-2025-53662 | Medium | 6.5 | 2025-07-09 | Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins controller, where they c… |
CVE-2025-53660 | Medium | 4.3 | 2025-07-09 | Jenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job configuration form, increasing the potenti… |
CVE-2025-53656 | Medium | 6.5 | 2025-07-09 | Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in job config.xml files o… |
CVE-2025-53655 | Medium | 5.3 | 2025-07-09 | Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers… |
CVE-2025-1709 | Medium | 6.5 | 2025-07-03 | Several credentials for the local PostgreSQL database are stored in plain text (partially base64 encoded). |
CVE-2025-6561 | Critical | 9.8 | 2025-06-26 | Certain hybrid DVR models ((HBF-09KD and HBF-16NK)) from Hunt Electronic have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remo… |
CVE-2025-6560 | Critical | 9.8 | 2025-06-24 | Multiple wireless router models from Sapido have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to directly acce… |
CVE-2025-5893 | Critical | 9.8 | 2025-06-09 | Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to ac… |
CVE-2025-5760 | Medium | 4.9 | 2025-06-06 | The Simple History plugin for WordPress is vulnerable to sensitive data exposure via Detective Mode due to improper sanitization within the append_debug_info_t… |
CVE-2025-2500 | High | 7.4 | 2025-05-30 | A vulnerability exists in the SOAP Web services of the Asset
Suite versions listed below. If successfully exploited, an attacker
could gain unauthorized acce… |
CVE-2025-48046 | | | 2025-05-29 | An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /config.php endpoint. |
CVE-2025-33079 | Medium | 6.5 | 2025-05-27 | IBM Controller 11.0.0, 11.0.1, and 11.1.0 application could allow an authenticated user to obtain sensitive credentials that may be inadvertently included with… |
CVE-2025-43005 | Medium | 4.3 | 2025-05-13 | SAP GUI for Windows allows an unauthenticated attacker to exploit insecure obfuscation algorithms used by the GuiXT application to store user credentials. Whil… |
CVE-2025-3758 | | | 2025-05-08 | WF2220 exposes endpoint /cgi-bin-igd/netcore_get.cgi that returns configuration of the device to unauthorized users. Returned configuration includes cleartext… |
CVE-2025-0936 | Medium | 6.5 | 2025-05-07 | On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cau… |
CVE-2025-4286 | Low | 2.7 | 2025-05-05 | A vulnerability was found in Intelbras InControl up to 2.21.59. It has been classified as problematic. Affected is an unknown function of the component Disposi… |
CVE-2025-2770 | Medium | 6.5 | 2025-04-23 | BEC Technologies Multiple Routers Cleartext Password Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensi… |
CVE-2025-25985 | Low | 2.6 | 2025-04-18 | An issue in Macro-video Technologies Co.,Ltd V380E6_C1 IP camera (Hw_HsAKPIQp_WF_XHR) 1020302 allows a physically proximate attacker to execute arbitrary code… |
CVE-2025-24375 | Medium | 5.0 | 2025-04-09 | Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-s… |
CVE-2025-31724 | Medium | 4.3 | 2025-04-02 | Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins cont… |
CVE-2024-43186 | Medium | 5.3 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that is stored locally under certain conditions. |
CVE-2024-9418 | Medium | 6.5 | 2025-03-20 | In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in plaintext. This vulnerability allows an… |
CVE-2025-2355 | Low | 3.3 | 2025-03-17 | A vulnerability was found in BlackVue App 3.65 on Android and classified as problematic. Affected by this issue is some unknown functionality of the component… |
CVE-2024-45638 | Medium | 4.1 | 2025-03-14 | IBM Security QRadar 3.12 EDR stores user credentials in plain text which can be read by a local privileged user. |
CVE-2025-27662 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005. |
CVE-2025-27656 | Critical | 9.8 | 2025-03-05 | Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2023-011. |
CVE-2025-25727 | Medium | 6.2 | 2025-02-28 | Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext. |
CVE-2024-41336 | High | 7.5 | 2025-02-27 | Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior to v3.9.9.4, Vigor… |
CVE-2024-10334 | High | 7.3 | 2025-02-10 | A vulnerability exists in the VideONet product included in the listed System 800xA versions, where VideONet is used.
An attacker who successfully exploited t… |
CVE-2023-50945 | Medium | 6.2 | 2025-01-26 | IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. |
CVE-2024-43659 | High | 7.2 | 2025-01-09 | After gaining access to the firmware of a charging station, a file at <redacted> can be accessed to obtain default credentials that are the same across all Ioc… |
CVE-2025-21111 | High | 7.5 | 2025-01-08 | Dell VxRail, versions 8.0.000 through 8.0.311, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could p… |
CVE-2025-21102 | High | 7.5 | 2025-01-08 | Dell VxRail, versions 7.0.000 through 7.0.532, contain(s) a Plaintext Storage of a Password vulnerability. A high privileged attacker with local access could p… |
CVE-2024-52361 | Medium | 5.7 | 2024-12-18 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.9
stores user credentials in plain text which can be read by an authenticated user with access… |