CVE-2026-65309 | High | 7.5 | 2026-07-31 | ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores
and transmits user passwords using a reversible format instead of a
one-way password hash… |
CVE-2026-1836 | | | 2026-06-12 | The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to the platform to retur… |
CVE-2026-22576 | Medium | 4.3 | 2026-04-14 | A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7… |
CVE-2026-22574 | Medium | 4.1 | 2026-04-14 | A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7… |
CVE-2025-8095 | | | 2026-04-14 | The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. It has been identified as cryptographically weak and unsuitable for st… |
CVE-2016-15058 | High | 8.1 | 2026-04-03 | Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure… |
CVE-2026-22614 | Medium | 6.1 | 2026-03-10 | The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and th… |
CVE-2026-30785 | Medium | 5.5 | 2026-03-05 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerab… |
CVE-2026-20128 | High | 7.5 | 2026-02-25 | A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user pr… |
CVE-2025-57796 | Medium | 6.8 | 2026-01-28 | Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords a… |
CVE-2025-14295 | | | 2026-01-22 | Storing Passwords in a Recoverable Format vulnerability in Automated Logic WebCTRL on Windows, Carrier i-Vu on Windows. Storing Passwords in a Recoverable Form… |
CVE-2025-8307 | | | 2026-01-08 | Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored… |
CVE-2025-34180 | | | 2025-12-15 | NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client, and Connectivity Server components. The key… |
CVE-2025-40774 | Medium | 4.4 | 2025-10-14 | A vulnerability has been identified in SiPass integrated (All versions < V3.0). Affected server applications store user passwords encrypted in its database. De… |
CVE-2025-35054 | Medium | 5.3 | 2025-10-09 | Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encr… |
CVE-2025-0280 | High | 7.5 | 2025-09-03 | A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access. |
CVE-2025-58049 | Medium | 5.8 | 2025-08-28 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1… |
CVE-2025-57789 | Medium | 5.4 | 2025-08-20 | During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control. This… |
CVE-2025-8904 | High | 8.5 | 2025-08-13 | Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory… |
CVE-2025-44958 | Medium | 5.3 | 2025-08-04 | RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format. |
CVE-2025-6996 | High | 8.4 | 2025-07-08 | Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker… |
CVE-2025-6995 | High | 8.4 | 2025-07-08 | Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker… |
CVE-2025-27459 | Medium | 4.4 | 2025-07-03 | The VNC application stores its passwords encrypted within the registry but uses DES for encryption. As DES is broken, the original passwords can be recovered. |
CVE-2024-51552 | Medium | 6.0 | 2025-05-22 | Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: through 3.*; NEXUS S… |
CVE-2025-25983 | Low | 3.4 | 2025-04-18 | An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive… |
CVE-2024-32122 | Low | 2.3 | 2025-04-08 | A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versio… |
CVE-2025-24852 | Medium | 4.6 | 2025-03-31 | Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. If this issue is exploited, an attacker who can acce… |
CVE-2024-8774 | | | 2025-03-24 | The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database admini… |
CVE-2024-32151 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-20462 | Medium | 5.5 | 2024-10-16 | A vulnerability in the web-based management interface of Cisco ATA 190 Series Multiplatform Analog Telephone Adapter firmware could allow an authenticated, loc… |
CVE-2024-45744 | Low | 3.0 | 2024-09-27 | TopQuadrant TopBraid EDG stores external credentials insecurely. An authenticated attacker with file system access can read edg-setup.properites and obtain the… |
CVE-2024-6694 | Low | 2.7 | 2024-07-20 | The WP Mail SMTP plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 4.0.1. This is due to plugin providing the SM… |
CVE-2024-32932 | Medium | 6.8 | 2024-07-02 | Under certain circumstances the web interface users credentials may be recovered by an authenticated user. |
CVE-2024-32756 | Medium | 6.8 | 2024-07-02 | Under certain circumstances the Linux users credentials may be recovered by an authenticated user. |
CVE-2024-3073 | Low | 2.7 | 2024-06-13 | The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and inclu… |
CVE-2024-32042 | Medium | 4.9 | 2024-05-15 | The key used to encrypt passwords stored in the database can be found in
the
CyberPower PowerPanel
application code, allowing the passwords to be recovered. |
CVE-2023-42955 | Medium | 4.9 | 2024-05-14 | Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console… |
CVE-2024-3543 | Medium | 6.4 | 2024-05-02 |
Use of reversible password encryption algorithm allows attackers to decrypt passwords. Sensitive information can be easily unencrypted by the attacker, stole… |
CVE-2024-1480 | High | 7.5 | 2024-04-19 | Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication. |
CVE-2023-38738 | Medium | 6.8 | 2024-01-19 |
IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in a OpenPages environment using Native authentication. If OpenPages is usin… |
CVE-2023-31001 | Medium | 5.1 | 2024-01-11 | IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporari… |
CVE-2023-5627 | High | 7.5 | 2023-11-01 | A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implemen… |
CVE-2023-2358 | Medium | 4.3 | 2023-09-27 |
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.5.0.0 and 9.3.0.4, including 8.3.x.x, saves passwords of the Hadoop Copy Files step in p… |
CVE-2022-47376 | High | 7.3 | 2023-06-13 | The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the… |
CVE-2023-2881 | Medium | 4.9 | 2023-05-25 | Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10. |
CVE-2023-31150 | High | 8.0 | 2023-05-10 |
A Storing Passwords in a Recoverable Format vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller (SEL RTAC) database syste… |
CVE-2023-23382 | Medium | 6.5 | 2023-02-14 | Azure Machine Learning Compute Instance Information Disclosure Vulnerability |
CVE-2022-32519 | High | 8.0 | 2023-01-30 | A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network… |
CVE-2023-21726 | High | 7.8 | 2023-01-10 | Windows Credential Manager User Interface Elevation of Privilege Vulnerability |
CVE-2022-46142 | Medium | 5.7 | 2022-12-13 | Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and decrypt the C… |
CVE-2022-22251 | High | 7.8 | 2022-10-18 | On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format in Junip… |
CVE-2022-34838 | High | 8.1 | 2022-08-24 | Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add or alter data p… |
CVE-2022-34837 | Medium | 6.2 | 2022-08-24 | Storing Passwords in a Recoverable Format vulnerability in ABB Zenon 8.20 allows an attacker who successfully exploit the vulnerability may add more network cl… |
CVE-2021-35050 | Medium | 6.5 | 2021-06-25 | User credentials stored in a recoverable format within Fidelis Network and Deception CommandPost. In the event that an attacker gains access to the CommandPost… |
CVE-2021-27485 | High | 7.5 | 2021-06-16 | ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their passwords in a recoverable format, which could allow an attacker to re… |
CVE-2020-8296 | Medium | 6.7 | 2021-03-03 | Nextcloud Server prior to 20.0.0 stores passwords in a recoverable format even when external storage is not configured. |
CVE-2021-0220 | Medium | 6.8 | 2021-01-15 | The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who… |
CVE-2019-18256 | Medium | 4.6 | 2020-06-29 | BIOTRONIK CardioMessenger II, The affected products use individual per-device credentials that are stored in a recoverable format. An attacker with physical ac… |
CVE-2019-19096 | Medium | 6.1 | 2020-04-02 | The Redis data structure component used in ABB eSOMS versions 6.0 to 6.0.2 stores credentials in clear text. If an attacker has file system access, this can po… |
CVE-2019-3736 | High | 7.2 | 2019-09-27 | Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a password storage vulnerability in the ACM component. A remote authenticated malic… |
CVE-2019-1010241 | Medium | 6.5 | 2019-07-19 | Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can reco… |
CVE-2019-6567 | Medium | 5.5 | 2019-06-12 | A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT switch family (incl… |
CVE-2019-5615 | Medium | 6.5 | 2019-04-09 | Users with Site-level permissions can access files containing the username-encrypted passwords of Security Console Global Administrators and clear-text passwor… |
CVE-2018-5446 | Medium | 4.9 | 2018-05-04 | Medtronic 2090 CareLink Programmer
uses a per-product username and password that is stored in a recoverable format. |
CVE-2017-9942 | High | 7.8 | 2017-08-08 | A vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that could allow an attacker with local access to the SiPass integrated… |