CVE-2026-76114 | Medium | 5.9 | 2026-09-29 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information vulnerability. An un… |
CVE-2026-101057 | Low | 3.1 | 2026-09-27 | utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration w… |
CVE-2026-100635 | Medium | 5.9 | 2026-09-26 | SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attribu… |
CVE-2026-82585 | Medium | 6.5 | 2026-09-24 | The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communic… |
CVE-2026-96550 | Low | 3.7 | 2026-09-23 | A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssm_… |
CVE-2026-18176 | High | 7.4 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sen… |
CVE-2026-18134 | High | 7.5 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sen… |
CVE-2026-86689 | Medium | 5.9 | 2026-09-18 | Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that… |
CVE-2025-36421 | Medium | 5.9 | 2026-09-18 | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive informati… |
CVE-2026-85720 | Medium | 5.9 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 a… |
CVE-2026-54586 | | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fe… |
CVE-2026-85719 | High | 7.5 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 a… |
CVE-2026-73174 | | | 2026-09-16 | Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-… |
CVE-2026-85628 | | | 2026-09-16 | Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors, in v… |
CVE-2026-69212 | Medium | 5.9 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers onl… |
CVE-2026-91988 | High | 8.1 | 2026-09-15 | atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers t… |
CVE-2026-31278 | High | 7.7 | 2026-09-14 | An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Di… |
CVE-2026-88013 | Low | 3.7 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attach… |
CVE-2026-81330 | Medium | 6.5 | 2026-09-09 | The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, a… |
CVE-2026-87482 | Medium | 5.9 | 2026-09-09 | Cleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to leak sensitive informa… |
CVE-2026-79588 | Medium | 4.3 | 2026-09-08 | U-speed WIFI4 N300 T1 Pro v1.0.0 is vulnerable to Cleartext transmission of administration credentials over HTTP. |
CVE-2026-71216 | Medium | 5.3 | 2026-09-04 | PagerDuty alarm hook transmits the integration routing key over cleartext HTTP.
PagerDuty serves this endpoint over HTTPS and will
normally answer plain HTT… |
CVE-2026-84381 | High | 8.1 | 2026-09-02 | HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpc… |
CVE-2026-84366 | High | 7.4 | 2026-09-01 | Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler co… |
CVE-2026-73756 | Medium | 5.9 | 2026-09-01 | A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-middle attack. Succ… |
CVE-2026-73743 | Low | 3.7 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to gain insight into som… |
CVE-2026-55860 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text pass… |
CVE-2026-55857 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog auth… |
CVE-2026-55854 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB… |
CVE-2026-81836 | Low | 3.7 | 2026-08-28 | A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of… |
CVE-2026-73809 | High | 7.5 | 2026-08-28 | A cleartext transmission of sensitive information vulnerability exists
in certain Ebyte gateway products. The web management interface does not
adequately pr… |
CVE-2026-69658 | Critical | 9.8 | 2026-08-28 | MQTT credentials and control traffic are transmitted in cleartext,
exposing sensitive information to network-level attackers. This may
enable unauthorized de… |
CVE-2026-81691 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigu… |
CVE-2026-19854 | Medium | 6.1 | 2026-08-27 | When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to Cl… |
CVE-2026-29988 | High | 7.6 | 2026-08-26 | A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions… |
CVE-2026-79782 | Low | 3.1 | 2026-08-25 | rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can inter… |
CVE-2026-79779 | Medium | 5.3 | 2026-08-25 | rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over pl… |
CVE-2026-77131 | | | 2026-08-25 | When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the at… |
CVE-2026-12556 | | | 2026-08-24 | Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead t… |
CVE-2026-19683 | High | 7.4 | 2026-08-20 | A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication… |
CVE-2026-22306 | Critical | 10.0 | 2026-08-19 | Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext
transmission of sensitive information vulner… |
CVE-2026-76244 | | | 2026-08-19 | stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loop… |
CVE-2026-15806 | | | 2026-08-18 | The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not tak… |
CVE-2026-20294 | Medium | 6.5 | 2026-08-05 | A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive informat… |
CVE-2026-18536 | High | 7.5 | 2026-08-01 | Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP.
The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource… |
CVE-2026-64742 | Medium | 6.5 | 2026-07-27 | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 2… |
CVE-2026-3182 | Medium | 4.3 | 2026-07-21 | Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability. |
CVE-2026-47255 | High | 8.2 | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had… |
CVE-2026-48022 | Medium | 6.5 | 2026-07-17 | @hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before followi… |
CVE-2026-48978 | | | 2026-07-17 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge with… |
CVE-2026-34346 | Medium | 5.5 | 2026-07-14 | Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally. |
CVE-2026-53624 | Medium | 4.8 | 2026-07-08 | Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-… |
CVE-2025-36336 | Medium | 5.9 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 transmits data in clear text that could allow an attacker to obtain sensitive information using man in… |
CVE-2025-12530 | Medium | 5.9 | 2026-06-30 | IBM watsonx.data intelligence 5.2.2, 5.3.0, 5.3.1, 5.3.1 through Patch 1 transmits data in clear text that could allow an attacker to obtain sensitive informat… |
CVE-2026-55844 | High | 7.5 | 2026-06-29 | Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID all… |
CVE-2026-49486 | High | 7.5 | 2026-06-26 | The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was… |
CVE-2026-44726 | High | 7.4 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatibility layer could cause a TLS client to… |
CVE-2026-55568 | Medium | 5.9 | 2026-06-23 | Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the proxy is transmi… |
CVE-2025-15619 | Low | 3.5 | 2026-06-23 | HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario. |
CVE-2026-11833 | | | 2026-06-23 | Overview:
A vulnerability has been found in FAST/TOOLS and CI Server. The web server may return a response containing the CI Server setting information. This… |
CVE-2026-50034 | Medium | 6.5 | 2026-06-19 | An attacker within BLE communication range can passively intercept
wireless traffic and obtain sensitive health-related information,
including glucose measur… |
CVE-2026-50200 | High | 7.5 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint pr… |
CVE-2026-9741 | Medium | 6.5 | 2026-06-09 | A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results… |
CVE-2026-45432 | | | 2026-06-04 | This vulnerability exists in GX Earth ONT models due to the transmission of user credentials in plaintext over HTTP in its web management interface. A remote a… |
CVE-2026-8874 | High | 7.1 | 2026-06-03 | Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API… |
CVE-2026-36610 | Medium | 5.9 | 2026-06-03 | Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding. The firmware contains no TLS… |
CVE-2026-7666 | Low | 3.1 | 2026-06-03 | An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
`django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a p… |
CVE-2023-52951 | Medium | 5.9 | 2026-06-03 | A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain u… |
CVE-2026-10584 | Medium | 5.9 | 2026-06-02 | Proxy server in Graph Explorer before 3.0.1 falls back to HTTP when certificate files are missing, which might allow remote threat actors to obtain sensitive i… |
CVE-2026-43625 | Medium | 5.9 | 2026-06-01 | CodexBar prior to 0.32.0 contains a session cookie leakage vulnerability that allows network attackers to intercept imported browser session cookies by exploit… |
CVE-2026-25599 | Medium | 6.3 | 2026-06-01 | Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregat… |
CVE-2026-34126 | High | 7.5 | 2026-05-28 | TP-Link has identified a vulnerability in Tapo L535E v1.0 and v3.0, Tapo P300 v1.0, and Tapo D100C v1.0, where Bluetooth communication during the initial setup… |
CVE-2024-47269 | Medium | 4.9 | 2026-05-27 | Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 al… |
CVE-2026-48902 | Critical | 9.8 | 2026-05-26 | The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set. |
CVE-2026-24212 | High | 7.5 | 2026-05-26 | NVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive information is transmitted in clear text. A successful exploit of this vulnerability… |
CVE-2026-25608 | | | 2026-05-22 | STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain sensitive data such… |
CVE-2026-38740 | Medium | 5.3 | 2026-05-14 | Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information. The device transmits sensitive Session Descript… |
CVE-2025-62311 | Medium | 4.3 | 2026-05-14 | HCL AION is affected by a vulnerability where backend service details may be transmitted over insecure HTTP channels. This may expose sensitive information to… |
CVE-2025-62310 | Medium | 5.4 | 2026-05-14 | HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations. This may expose sensitive information to… |
CVE-2026-41281 | Medium | 4.8 | 2026-05-14 | Android App "あんしんフィルター for au" provided by KDDI CORPORATION contains Cleartext Transmission of Sensitive Information (CWE-319) vulnerability. A man-in-the-midd… |
CVE-2026-6276 | High | 7.5 | 2026-05-13 | Using libcurl, when a custom `Host:` header is first set for an HTTP request
and a second request is subsequently done using the same *easy handle* but
without… |
CVE-2026-4873 | Medium | 5.9 | 2026-05-13 | A vulnerability exists where a connection requiring TLS incorrectly reuses an
existing unencrypted connection from the same connection pool. If an initial
tran… |
CVE-2026-45180 | High | 7.5 | 2026-05-10 | Catalyst::Plugin::Statsd versions through 0.10.0 for Perl may leak session ids.
If the communication channel to the statsd daemon is not secured (for example… |
CVE-2026-45179 | Medium | 5.3 | 2026-05-10 | Plack::Middleware::Statsd versions before 0.9.0 for Perl may leak user IP addresses.
If the communication channel to the statsd daemon is not secured (for exa… |
CVE-2026-32683 | Medium | 5.3 | 2026-05-09 | Some EZVIZ products utilize older versions of cloud feature modules with legacy API interfaces, which pose a data transmission risk. Attackers can exploit this… |
CVE-2025-59852 | Low | 3.7 | 2026-05-06 | HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability where data is transmitted over the network without encryption, which… |
CVE-2026-7610 | Low | 3.7 | 2026-05-02 | A vulnerability has been found in TRENDnet TEW-821DAP 1.12B01. This affects an unknown function of the file /www/cgi/ssi of the component Firmware Update. Such… |
CVE-2026-42514 | | | 2026-04-29 | This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A remote attacker could exploit this vulnerability by interce… |
CVE-2026-40431 | Medium | 5.3 | 2026-04-24 | A vulnerability exists in SenseLive X3050’s web management interface due to its reliance on unencrypted HTTP for all administrative communication. Because mana… |
CVE-2026-41275 | High | 7.5 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the password reset functionality on cloud.flowiseai.co… |
CVE-2025-31981 | Medium | 5.3 | 2026-04-21 | HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker… |
CVE-2026-40045 | Medium | 5.7 | 2026-04-21 | OpenClaw before 2026.4.2 accepts non-loopback cleartext ws:// gateway endpoints and transmits stored gateway credentials over unencrypted connections. Attacker… |
CVE-2026-6066 | High | 7.1 | 2026-04-20 | ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client… |
CVE-2026-33569 | Medium | 6.5 | 2026-04-17 | Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling
on‑path attackers to sniff credentials and session data, which can be
used to compro… |
CVE-2026-33472 | Medium | 4.8 | 2026-04-16 | Cryptomator is an open-source client-side encryption application for cloud storage. Version 1.19.1 contains a logic flaw in CheckHostTrustController.getAuthori… |
CVE-2026-22155 | Medium | 6.5 | 2026-04-14 | A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR P… |
CVE-2026-21742 | Medium | 5.7 | 2026-04-14 | A cleartext transmission of sensitive information vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR P… |
CVE-2026-31924 | Medium | 5.3 | 2026-04-14 | Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.
tencent-cloud-cls log export uses plaintext HTTP
This issue affects Apache API… |
CVE-2026-31923 | High | 7.5 | 2026-04-14 | Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX.
This can occur due to `ssl_verify` in openid-connect plugin configuration bein… |
CVE-2026-4820 | Medium | 4.3 | 2026-04-01 | IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to ge… |