CVE-2026-68970 | Medium | 6.5 | 2026-08-12 | Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task log… |
CVE-2026-66016 | Medium | 6.7 | 2026-08-12 | Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users. |
CVE-2026-59244 | Medium | 6.5 | 2026-08-12 | Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstan… |
CVE-2026-61928 | Medium | 5.5 | 2026-08-11 | Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally. |
CVE-2026-47702 | | | 2026-08-11 | TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credentials used to authenticate against the builder API) are stored in the database a… |
CVE-2026-19391 | Medium | 6.5 | 2026-08-11 | A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows… |
CVE-2026-21080 | | | 2026-08-10 | Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. |
CVE-2026-20312 | High | 8.8 | 2026-08-05 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive inter… |
CVE-2026-55997 | High | 8.8 | 2026-08-05 | Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext… |
CVE-2026-15721 | Critical | 9.8 | 2026-08-04 | Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injecti… |
CVE-2026-18591 | Low | 2.1 | 2026-08-03 | A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the compo… |
CVE-2026-34490 | Medium | 5.5 | 2026-07-31 | Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compro… |
CVE-2026-59327 | Medium | 4.4 | 2026-07-30 | Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain string attribute on the "Spring Boot DevTools… |
CVE-2026-55985 | Medium | 4.3 | 2026-07-24 | The web management interface in
Tycon Systems TPDIN-Monitor-WEB2
stores and displays system credentials in cleartext on a certain configuration page accessib… |
CVE-2026-16802 | Medium | 6.5 | 2026-07-24 | Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file sys… |
CVE-2024-58023 | High | 8.4 | 2026-07-23 | Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information. |
CVE-2026-65599 | Medium | 6.5 | 2026-07-22 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM p… |
CVE-2026-13380 | High | 7.5 | 2026-07-20 | VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are p… |
CVE-2026-16213 | Low | 3.3 | 2026-07-19 | A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an unknown functionality of the file zinnia/… |
CVE-2026-55885 | Medium | 6.8 | 2026-07-10 | Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav… |
CVE-2026-8804 | | | 2026-07-03 | Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the r… |
CVE-2026-38571 | Medium | 4.6 | 2026-06-26 | Cleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr memory read/write commands, in the unauthenticated UART debug conso… |
CVE-2026-57287 | Medium | 4.3 | 2026-06-24 | Jenkins Job Configuration History Plugin 1356.ve360da_6c523a_ and earlier does not redact the encrypted values of secrets when displaying historical job and ag… |
CVE-2026-50267 | Medium | 4.7 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstract… |
CVE-2026-46622 | High | 8.1 | 2026-06-11 | SolidInvoice is an open-source invoicing platform. Prior to version 2.3.17, API tokens used to authenticate all REST API requests are stored as plaintext strin… |
CVE-2026-10786 | Medium | 6.5 | 2026-06-08 | Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials… |
CVE-2026-36176 | High | 7.1 | 2026-06-04 | GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console. This allows physically-proximat… |
CVE-2026-4387 | | | 2026-05-29 | StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and as… |
CVE-2026-45040 | | | 2026-05-28 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive information leakage in log outputs. When the… |
CVE-2026-9274 | | | 2026-05-25 | This vulnerability exists in CP Plus Wi-Fi Camera due to improper protection of sensitive information in runtime memory. An attacker with physical access could… |
CVE-2026-8596 | High | 7.2 | 2026-05-14 | Cleartext storage of sensitive information in the ModelBuilder/Serve component in Amazon SageMaker Python SDK before v2.257.2 and v3 before v3.8.0 might allow… |
CVE-2026-6332 | High | 7.5 | 2026-05-14 | CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in reve… |
CVE-2026-42408 | Medium | 4.4 | 2026-05-13 | When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to… |
CVE-2026-28758 | Medium | 4.4 | 2026-05-13 | When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext… |
CVE-2026-43992 | Critical | 9.8 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract… |
CVE-2026-45362 | Low | 3.2 | 2026-05-12 | Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file. |
CVE-2026-41520 | High | 7.9 | 2026-05-08 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.15, 1.18.9, and 1.19.3, the output of cilium-… |
CVE-2026-43942 | Medium | 5.5 | 2026-05-08 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In versions 3.8.15 and prior, the getConstants() IPC handler in src/a… |
CVE-2026-8026 | Low | 3.7 | 2026-05-06 | A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/accou… |
CVE-2026-42151 | High | 7.5 | 2026-05-04 | Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote wri… |
CVE-2026-43824 | High | 7.7 | 2026-05-02 | In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secret data. |
CVE-2026-7163 | Medium | 6.1 | 2026-04-30 | A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authe… |
CVE-2026-41385 | Medium | 6.5 | 2026-04-28 | OpenClaw before 2026.3.31 stores Nostr privateKey as plaintext in configuration, allowing exposure through config.get method calls that bypass redaction mechan… |
CVE-2026-6796 | Medium | 4.3 | 2026-04-21 | A vulnerability was determined in Sanluan PublicCMS up to 6.202506.d. Affected is the function log_login of the file core/src/main/java/com/publiccms/controlle… |
CVE-2026-6553 | High | 7.5 | 2026-04-21 | Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users dat… |
CVE-2026-6598 | Medium | 4.3 | 2026-04-20 | A security vulnerability has been detected in langflow-ai langflow up to 1.8.3. The affected element is the function create_project/encrypt_auth_settings of th… |
CVE-2026-35644 | Medium | 6.5 | 2026-04-09 | OpenClaw before 2026.3.22 contains an information disclosure vulnerability that allows attackers with operator.read scope to expose credentials embedded in cha… |
CVE-2026-39943 | Medium | 6.5 | 2026-04-09 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus stores revision records (in directus_revisions) whe… |
CVE-2025-14815 | | | 2026-04-08 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite version… |
CVE-2026-5531 | Medium | 5.3 | 2026-04-05 | A vulnerability has been found in SourceCodester Student Result Management System 1.0. Impacted is an unknown function of the file /login_credentials.txt of th… |
CVE-2026-34833 | High | 7.5 | 2026-04-02 | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the u… |
CVE-2026-34214 | High | 7.7 | 2026-03-31 | Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (acce… |
CVE-2026-33026 | Critical | 9.1 | 2026-03-30 | Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encryp… |
CVE-2026-33867 | High | 7.5 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individual videos. The vid… |
CVE-2026-27877 | Medium | 6.5 | 2026-03-27 | When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being used in dashboards.
No passwords of pro… |
CVE-2026-4346 | Medium | 6.8 | 2026-03-26 | The vulnerability affecting TL-WR850N v3 allows cleartext storage of administrative and Wi-Fi credentials in a region of the device’s flash memory while the se… |
CVE-2026-33512 | High | 7.5 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication… |
CVE-2026-31848 | Critical | 9.8 | 2026-03-23 | Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data comb… |
CVE-2026-33003 | Medium | 4.3 | 2026-03-18 | Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by us… |
CVE-2026-32842 | Medium | 6.5 | 2026-03-17 | Edimax GS-5008PL firmware version 1.00.54 and prior contain an insecure credential storage vulnerability that allows attackers to obtain administrator credenti… |
CVE-2025-55717 | Medium | 4.0 | 2026-03-10 | A cleartext storage of sensitive information vulnerability [CWE-312] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.2, FortiMail 7.4.0 through 7.4.4, Fo… |
CVE-2026-24311 | Medium | 5.6 | 2026-03-10 | The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversible protection mechani… |
CVE-2025-36105 | Medium | 4.4 | 2026-03-10 | IBM Planning Analytics Advanced Certified Containers 3.1.0 through 3.1.4 could allow a local privileged user to obtain sensitive information from environment v… |
CVE-2025-70050 | Medium | 6.5 | 2026-03-09 | An issue pertaining to CWE-312: Cleartext Storage of Sensitive Information was discovered in lesspass lesspass v9.6.9 which allows attackers to obtain sensitiv… |
CVE-2024-55027 | High | 7.5 | 2026-03-03 | Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to stroe credentials in plaintext in the component uac_temp.db. |
CVE-2025-47147 | Medium | 5.7 | 2026-03-03 | Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in… |
CVE-2026-3277 | Medium | 6.5 | 2026-02-27 | The OpenID Connect (OIDC) authentication configuration in PowerShell
Universal before 2026.1.3 stores the OIDC client secret in cleartext in
the .universal/a… |
CVE-2026-3221 | Medium | 4.9 | 2026-02-25 | Sensitive
user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with
access to the… |
CVE-2026-27520 | High | 7.5 | 2026-02-24 | Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 store a user password in a client-side cookie as a Base64-encoded value accessi… |
CVE-2026-23655 | Medium | 6.5 | 2026-02-10 | Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network. |
CVE-2026-24319 | Medium | 5.8 | 2026-02-10 | In SAP Business One, sensitive information is written to the application�s memory dump files without obfuscation. Gaining access to this information could pote… |
CVE-2025-10464 | Medium | 6.5 | 2026-02-09 | Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensi… |
CVE-2026-25751 | High | 7.5 | 2026-02-06 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote att… |
CVE-2025-33081 | Low | 3.3 | 2026-02-03 | IBM Concert 1.0.0 through 2.1.0 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2025-12774 | High | 7.5 | 2026-02-03 | A vulnerability in the migration script for Brocade SANnav before 3.0 could allow the collection of database sql queries in the SANnav support save file. An at… |
CVE-2025-12772 | Medium | 4.9 | 2026-02-02 | Brocade SANnav before 2.4.0b logs the Brocade Fabric OS Switch admin password on the SANnav support save logs.
When OOM occurs on a Brocade SANnav server, the… |
CVE-2025-12680 | Medium | 4.9 | 2026-02-02 | Brocade SANnav before Brocade SANnav 2.4.0b logs database passwords in clear text in the standby SANnav server, after disaster recovery failover. The vulnerab… |
CVE-2025-12679 | Medium | 6.5 | 2026-02-02 | A vulnerability in Brocade SANnav before 2.4.0b prints the
Password-Based Encryption (PBE) key in plaintext in the system audit log
file. The vulnerability c… |
CVE-2024-9432 | | | 2026-01-30 | Cleartext Storage of Sensitive Information vulnerability in OpenText™ Vertica allows Retrieve Embedded Sensitive Data.
The vulnerability could read Vertica… |
CVE-2025-59105 | | | 2026-01-26 | With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Th… |
CVE-2025-59102 | | | 2026-01-26 | The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole c… |
CVE-2026-22276 | Medium | 5.5 | 2026-01-23 | Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Storage of Sensitive Information vulnerability… |
CVE-2025-14377 | | | 2026-01-20 | A security issue was discovered within the legacy Ansible playbook component of Verve Asset Manager, caused by plaintext secrets incorrectly stored when a play… |
CVE-2026-22240 | High | 7.5 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated re… |
CVE-2019-25279 | High | 7.5 | 2026-01-08 | FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to access unencrypted credentials in the devic… |
CVE-2025-14836 | Low | 2.7 | 2025-12-17 | A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the component User Data Stora… |
CVE-2025-11009 | Medium | 5.1 | 2025-12-17 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GT Designer3 Version1 (GOT2000) all versions and Mitsubishi Electric GT Designe… |
CVE-2025-65826 | Critical | 9.8 | 2025-12-10 | The mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and found the physical locat… |
CVE-2020-36887 | High | 7.5 | 2025-12-10 | SpinetiX Fusion Digital Signage 3.4.8 contains an unauthenticated information disclosure vulnerability in the database backup directory. Attackers can access t… |
CVE-2025-34428 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover… |
CVE-2025-34427 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover… |
CVE-2025-67638 | Medium | 4.3 | 2025-12-10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential f… |
CVE-2025-67637 | Medium | 4.3 | 2025-12-10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they c… |
CVE-2024-58277 | | | 2025-12-04 | R Radio Network FM Transmitter 1.07 allows unauthenticated attackers to access the admin user's password through the system.cgi endpoint, enabling authenticati… |
CVE-2025-65320 | High | 7.5 | 2025-12-03 | Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid de… |
CVE-2025-59701 | Medium | 4.1 | 2025-12-02 | Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a physically proximate attacker (with elevated privileges) to read and… |
CVE-2025-59792 | Medium | 5.3 | 2025-11-28 | Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks.
This issue affects Apache Kvrocks: from 1.0.0 through 2.13.0.
Users are… |
CVE-2025-3784 | Medium | 5.5 | 2025-11-27 | Cleartext Storage of Sensitive Information Vulnerability in GX Works2 all versions allows an attacker to disclose credential information stored in plaintext fr… |
CVE-2025-65278 | High | 7.5 | 2025-11-26 | An issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing unauthenticated attackers to gain sensitive information includin… |
CVE-2025-63729 | Critical | 9.0 | 2025-11-25 | An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SSL Certific… |