CVE-2026-19891 | Low | 3.7 | 2026-08-15 | A vulnerability was determined in TRENDnet TEW-WLC100 2.05b02. This affects an unknown function of the file /etc/racoon.conf of the component IKE Phase 1 Aggre… |
CVE-2026-21079 | | | 2026-08-10 | Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data. |
CVE-2026-20157 | High | 7.5 | 2026-07-15 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal secur… |
CVE-2025-63579 | High | 7.5 | 2026-07-09 | Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming dat… |
CVE-2026-54784 | High | 7.4 | 2026-07-08 | CoreWCF is a port of the service side of Windows Communication Foundation (WCF) to .NET Core. In version 1.9.0, CoreWCF SPNEGO SecurityContextToken negotiation… |
CVE-2026-55568 | Medium | 5.9 | 2026-06-23 | Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the proxy is transmi… |
CVE-2026-53442 | Medium | 5.3 | 2026-06-10 | Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencryp… |
CVE-2026-34486 | High | 7.5 | 2026-04-09 | Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor.
This issu… |
CVE-2026-34992 | High | 7.5 | 2026-04-06 | Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to 2.4.5 and 2.5.2, a missing encryption vulnerability affects inter-Node Po… |
CVE-2026-32891 | Critical | 9.0 | 2026-03-20 | Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and below contai… |
CVE-2026-27944 | Critical | 9.8 | 2026-03-05 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses… |
CVE-2025-69969 | Critical | 9.6 | 2026-03-04 | A lack of authentication and authorization mechanisms in the Bluetooth Low Energy (BLE) communication protocol of SRK Powertech Pvt Ltd Pebble Prism Ultra v2.9… |
CVE-2025-15548 | Medium | 6.5 | 2026-01-29 | Some VX800v v1.0 web interface endpoints transmit sensitive information over unencrypted HTTP due to missing application layer encryption, allowing a network a… |
CVE-2025-65098 | High | 7.4 | 2026-01-22 | Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any… |
CVE-2025-13453 | Medium | 4.6 | 2026-01-14 | A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the drive. |
CVE-2025-15065 | Medium | 6.3 | 2025-12-29 | Exposure of Sensitive Information to an Unauthorized Actor, Missing Encryption of Sensitive Data, Files or Directories Accessible to External Parties vulnerabi… |
CVE-2025-36751 | | | 2025-12-13 | Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept a… |
CVE-2025-13053 | Low | 3.7 | 2025-12-12 | When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept n… |
CVE-2025-65825 | Medium | 4.6 | 2025-12-10 | The firmware on the basestation of the Meatmeet is not encrypted. An adversary with physical access to the Meatmeet device can disassemble the device, connect… |
CVE-2025-64147 | Medium | 4.3 | 2025-10-29 | Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and c… |
CVE-2025-64146 | Medium | 4.3 | 2025-10-29 | Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with It… |
CVE-2025-64145 | Medium | 4.3 | 2025-10-29 | Jenkins ByteGuard Build Actions Plugin 1.0 does not mask API tokens displayed on the job configuration form, increasing the potential for attackers to observe… |
CVE-2025-64144 | Medium | 4.3 | 2025-10-29 | Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users wi… |
CVE-2025-64143 | Medium | 4.3 | 2025-10-29 | Jenkins OpenShift Pipeline Plugin 1.0.57 and earlier stores authorization tokens unencrypted in job config.xml files on the Jenkins controller where they can b… |
CVE-2025-48981 | High | 8.6 | 2025-10-08 | An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and manipulate data on the… |
CVE-2025-59410 | Low | 3.7 | 2025-09-17 | Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the code in the scheduler for downloading a tiny file is… |
CVE-2025-10227 | Medium | 4.6 | 2025-09-10 | Missing Encryption of Sensitive Data (CWE-311) in the Object Archive component in AxxonSoft Axxon One (C-Werk) before 2.0.8 on Windows and Linux allows a loca… |
CVE-2025-31977 | Medium | 5.3 | 2025-08-28 | HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness… |
CVE-2025-48862 | High | 7.1 | 2025-08-14 | Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set… |
CVE-2024-41982 | Medium | 4.8 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2024-41980 | Low | 3.1 | 2025-08-12 | A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SO… |
CVE-2025-8763 | Low | 3.7 | 2025-08-09 | A vulnerability was found in Ruijie EG306MG 3.0(1)B11P309. It has been rated as problematic. This issue affects some unknown processing of the file /etc/strong… |
CVE-2025-45768 | High | 7.0 | 2025-07-31 | pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses t… |
CVE-2025-43274 | Medium | 4.4 | 2025-07-30 | A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.6. A sandboxed process may be able to circumvent sandbox… |
CVE-2025-40680 | | | 2025-07-24 | Lack of sensitive data encryption in CapillaryScope v2.5.0 of Capillary io, which stores both the proxy credentials and the JWT session token in plain text wit… |
CVE-2025-33020 | Medium | 5.9 | 2025-07-23 | IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 transmits sensitive information without encryption that could allow an attacker to obtain highl… |
CVE-2025-36062 | Medium | 5.9 | 2025-07-21 | IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22
could be vulnerable to information exposure due to the use of unencrypted network traffic. |
CVE-2025-53678 | Medium | 6.5 | 2025-07-09 | Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it ca… |
CVE-2025-53676 | Medium | 6.5 | 2025-07-09 | Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be… |
CVE-2025-53673 | Medium | 6.5 | 2025-07-09 | Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins co… |
CVE-2025-53668 | Medium | 6.5 | 2025-07-09 | Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by us… |
CVE-2025-53666 | Medium | 6.5 | 2025-07-09 | Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by… |
CVE-2025-53663 | Medium | 6.5 | 2025-07-09 | Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller, where… |
CVE-2025-53659 | Medium | 6.5 | 2025-07-09 | Jenkins QMetry Test Management Plugin 1.13 and earlier stores Qmetry Automation API Keys unencrypted in job config.xml files on the Jenkins controller, where t… |
CVE-2025-53653 | Medium | 4.3 | 2025-07-09 | Jenkins Aqua Security Scanner Plugin 3.2.8 and earlier stores Scanner Tokens for Aqua API unencrypted in job config.xml files on the Jenkins controller, where… |
CVE-2014-6274 | High | 7.5 | 2025-06-26 | git-annex had a bug in the S3 and Glacier remotes where if embedcreds=yes
was set, and the remote used encryption=pubkey or encryption=hybrid,
the embedded AWS… |
CVE-2025-32875 | Medium | 5.7 | 2025-06-20 | An issue was discovered in the COROS application through 3.8.12 for Android. Bluetooth pairing and bonding is neither initiated nor enforced by the application… |
CVE-2025-24008 | Medium | 6.5 | 2025-05-13 | A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). The affected devices d… |
CVE-2025-47274 | | | 2025-05-12 | ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Due to the ordering of code used to start an… |
CVE-2023-37405 | Medium | 6.5 | 2025-03-27 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, and 2.3.4.1 stor… |
CVE-2025-29314 | High | 8.1 | 2025-03-24 | Insecure Shiro cookie configurations in OpenDaylight Service Function Chaining (SFC) Subproject SFC Sodium-SR4 and below allow attackers to access sensitive in… |
CVE-2025-1243 | | | 2025-02-12 | The Temporal api-go library prior to version 1.44.1 did not send `update response` information to Data Converter when the proxy package within the api-go modul… |
CVE-2024-38325 | Medium | 5.9 | 2025-01-27 | IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI
could allow a remote attacker to obtain sensitive information, caused by sending net… |
CVE-2024-41757 | Medium | 5.9 | 2025-01-24 | IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transp… |
CVE-2024-7142 | Medium | 4.6 | 2025-01-10 | On Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only), the disk encryption mig… |
CVE-2024-56439 | High | 7.5 | 2025-01-08 | Access control vulnerability in the identity authentication module
Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-47871 | Critical | 9.1 | 2024-10-10 | Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves **insecure communication** between the FRP (Fast Reverse Pr… |
CVE-2024-20515 | Medium | 6.5 | 2024-10-02 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive… |
CVE-2023-52950 | Medium | 5.3 | 2024-09-26 | Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the… |
CVE-2023-52948 | Medium | 5.0 | 2024-09-26 | Missing encryption of sensitive data vulnerability in settings functionality in Synology Active Backup for Business Agent before 2.7.0-3221 allows local users… |
CVE-2024-42495 | Medium | 6.5 | 2024-09-05 | Credentials to access device configuration were transmitted using an unencrypted protocol. These credentials would allow read-only access to network configurat… |
CVE-2024-20503 | Medium | 5.5 | 2024-09-04 | A vulnerability in Cisco Duo Epic for Hyperdrive could allow an authenticated, local attacker to view sensitive information in cleartext on an affected system… |
CVE-2024-42657 | High | 7.5 | 2024-08-19 | An issue in wishnet Nepstech Wifi Router NTPL-XPON1GFEVN v1.0 allows a remote attacker to obtain sensitive information via the lack of encryption during login… |
CVE-2024-40620 | High | 7.5 | 2024-08-14 | CVE-2024-40620 IMPACT
A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data bei… |
CVE-2024-7396 | | | 2024-08-05 | Missing encryption of sensitive data in Korenix JetPort 5601v3 allows Eavesdropping.This issue affects JetPort 5601v3: through 1.2. |
CVE-2024-23444 | Medium | 4.9 | 2024-07-31 | It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing Req… |
CVE-2024-41124 | Medium | 6.3 | 2024-07-19 | Puncia is the Official CLI utility for Subdomain Center & Exploit Observer. `API_URLS` is utilizing HTTP instead of HTTPS for communication that can lead to is… |
CVE-2024-38302 | Medium | 6.8 | 2024-07-18 | Dell Data Lakehouse, version(s) 1.0.0.0, contain(s) a Missing Encryption of Sensitive Data vulnerability in the DDAE (Starburst). A low privileged attacker wit… |
CVE-2024-5731 | Medium | 6.8 | 2024-06-14 | A vulnerability in the IPS Manager, Central Manager, and Local Manager communication workflow allows an attacker to control the destination of a request by man… |
CVE-2024-38283 | | | 2024-06-13 | Sensitive customer information is stored in the device without encryption. |
CVE-2023-49927 | Medium | 5.3 | 2024-06-05 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, Exynos 990, Exynos 850, Exynos 1080, Exynos 2100, Exynos 2200, E… |
CVE-2024-35061 | High | 7.3 | 2024-05-21 | NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack. Wh… |
CVE-2024-27106 | Medium | 5.7 | 2024-05-14 | Vulnerable data in transit in GE HealthCare EchoPAC products |
CVE-2024-25027 | Medium | 6.2 | 2024-03-31 | IBM Security Verify Access 10.0.6 could disclose sensitive snapshot information due to missing encryption. IBM X-Force ID: 281607. |
CVE-2023-35888 | Medium | 5.9 | 2024-03-20 | IBM Security Verify Governance 10.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Trans… |
CVE-2024-28250 | Medium | 6.1 | 2024-03-18 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2… |
CVE-2024-28249 | Medium | 6.1 | 2024-03-18 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.13.13, 1.14.8, and 1.15.2, in Cilium clusters wi… |
CVE-2024-29151 | Critical | 9.1 | 2024-03-18 | Rocket.Chat.Audit through 5ad78e8 depends on filecachetools, which does not exist in PyPI. |
CVE-2021-39090 | Medium | 5.9 | 2024-02-29 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly en… |
CVE-2024-25631 | Medium | 6.1 | 2024-02-20 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who have enabled an external kvstore and Wireguard… |
CVE-2024-25630 | Medium | 6.1 | 2024-02-20 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state (the defau… |
CVE-2024-24768 | Medium | 6.5 | 2024-02-05 | 1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword… |
CVE-2023-50129 | Medium | 6.5 | 2024-01-11 | Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity to the original tags… |
CVE-2023-50126 | Medium | 6.5 | 2024-01-11 | Missing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned tag via brief physical proximity to one o… |
CVE-2023-38267 | Medium | 6.2 | 2024-01-11 | IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could all… |
CVE-2023-6339 | Critical | 10.0 | 2024-01-02 | Google Nest WiFi Pro root code-execution & user-data compromise |
CVE-2023-33037 | High | 7.1 | 2024-01-02 | Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data. |
CVE-2023-46219 | Medium | 5.3 | 2023-12-12 | When saving HSTS data to an excessively long file name, curl could end up
removing all contents, making subsequent requests using that file unaware of
the HSTS… |
CVE-2023-42019 | Medium | 5.9 | 2023-12-01 |
IBM InfoSphere Information Server 11.7 could allow a remote attacker to cause a denial of service due to improper input validation. IBM X-Force ID: 265161… |
CVE-2023-44098 | High | 7.5 | 2023-11-08 | Vulnerability of missing encryption in the card management module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-33228 | Medium | 4.5 | 2023-11-01 | The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with admin… |
CVE-2023-41096 | Medium | 6.8 | 2023-10-26 | Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules)
allows potential modification or ex… |
CVE-2023-41095 | Medium | 6.8 | 2023-10-26 | Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or ext… |
CVE-2023-33837 | Medium | 4.1 | 2023-10-23 | IBM Security Verify Governance 10.0 does not encrypt sensitive or critical information before storage or transmission. IBM X-Force ID: 256020. |
CVE-2022-22386 | Medium | 5.3 | 2023-10-17 |
IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP St… |
CVE-2022-22377 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Str… |
CVE-2022-33161 | Medium | 5.3 | 2023-10-14 | IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpo… |
CVE-2023-23371 | Medium | 5.2 | 2023-10-06 | A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow loc… |
CVE-2023-43618 | Medium | 5.3 | 2023-09-20 | An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message. |
CVE-2023-4580 | Medium | 6.5 | 2023-09-11 | Push notifications stored on disk in private browsing mode were not being encrypted potentially allowing the leak of sensitive information. This vulnerability… |