CVE-2026-15102 | High | 7.5 | 2026-10-14 | ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized… |
CVE-2026-92832 | Medium | 5.1 | 2026-10-12 | IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive infor… |
CVE-2026-85975 | High | 7.5 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may use cleartext transport for Amazon S3 connections by default. A netwo… |
CVE-2026-85973 | High | 7.4 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 may use cleartext transport for certain cluster-management communications. A network-positioned attacker… |
CVE-2026-108716 | Medium | 5.3 | 2026-10-11 | mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens withou… |
CVE-2026-107714 | Medium | 5.9 | 2026-10-08 | The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats redirects as same-orig… |
CVE-2026-104704 | High | 7.4 | 2026-10-08 | Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records conta… |
CVE-2026-107285 | Medium | 5.9 | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16… |
CVE-2026-107282 | | | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16… |
CVE-2026-107232 | High | 7.5 | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x an… |
CVE-2026-107231 | | | 2026-10-07 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16… |
CVE-2026-92543 | | | 2026-10-07 | Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CID… |
CVE-2026-107121 | Medium | 6.5 | 2026-10-07 | A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly e… |
CVE-2026-105766 | Low | 3.1 | 2026-10-05 | Use of the backend-facing $scheme variable in the trailing-slash directory redirect in nginx.conf of Chainguard Academy (edu) from commit 0b75ff98057f69b044a3e… |
CVE-2026-105245 | Low | 3.7 | 2026-10-05 | A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server_info of the file python/sglang/srt/entrypoints/http_s… |
CVE-2026-103098 | High | 7.5 | 2026-10-02 | Transmission of a sensitive key in the URL
over an unencrypted HTTP connection. The
request is sent over HTTP rather than HTTPS, meaning the key is transmitte… |
CVE-2026-64893 | | | 2026-10-01 | - Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack.
This issue affects EasyIO NE… |
CVE-2026-55396 | | | 2026-10-01 | Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 (… |
CVE-2026-55394 | | | 2026-10-01 | Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or m… |
CVE-2026-14984 | | | 2026-10-01 | Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept… |
CVE-2026-102670 | Medium | 4.3 | 2026-10-01 | Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it. |
CVE-2026-67105 | High | 7.4 | 2026-10-01 | HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept u… |
CVE-2026-82826 | High | 7.5 | 2026-10-01 | Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attacker to eavesdrop on… |
CVE-2026-76114 | Medium | 5.9 | 2026-09-29 | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information vulnerability. An un… |
CVE-2026-101057 | Low | 3.1 | 2026-09-27 | utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers configuration w… |
CVE-2026-100635 | Medium | 5.9 | 2026-09-26 | SiYuan before v3.8.4 contains an authentication bypass vulnerability in the publish service where session cookies are issued without Secure or SameSite attribu… |
CVE-2026-82585 | Medium | 6.5 | 2026-09-24 | The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communic… |
CVE-2026-96550 | Low | 3.7 | 2026-09-23 | A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperties of the file ssm_… |
CVE-2026-18176 | High | 7.4 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sen… |
CVE-2026-18134 | High | 7.5 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sen… |
CVE-2026-86689 | Medium | 5.9 | 2026-09-18 | Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that… |
CVE-2025-36421 | Medium | 5.9 | 2026-09-18 | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive informati… |
CVE-2026-85720 | Medium | 5.9 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 a… |
CVE-2026-54586 | | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fe… |
CVE-2026-85719 | High | 7.5 | 2026-09-17 | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 2.16.1 a… |
CVE-2026-73174 | | | 2026-09-16 | Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocol of Advantech EKI-… |
CVE-2026-85628 | | | 2026-09-16 | Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors, in v… |
CVE-2026-69212 | Medium | 5.9 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers onl… |
CVE-2026-91988 | High | 8.1 | 2026-09-15 | atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers t… |
CVE-2026-31278 | High | 7.7 | 2026-09-14 | An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Di… |
CVE-2026-88013 | Low | 3.7 | 2026-09-10 | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attach… |
CVE-2026-81330 | Medium | 6.5 | 2026-09-09 | The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, a… |
CVE-2026-87482 | Medium | 5.9 | 2026-09-09 | Cleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to leak sensitive informa… |
CVE-2026-79588 | Medium | 4.3 | 2026-09-08 | U-speed WIFI4 N300 T1 Pro v1.0.0 is vulnerable to Cleartext transmission of administration credentials over HTTP. |
CVE-2026-71216 | Medium | 5.3 | 2026-09-04 | PagerDuty alarm hook transmits the integration routing key over cleartext HTTP.
PagerDuty serves this endpoint over HTTPS and will
normally answer plain HTT… |
CVE-2026-84381 | High | 8.1 | 2026-09-02 | HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpc… |
CVE-2026-84366 | High | 7.4 | 2026-09-01 | Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler co… |
CVE-2026-73756 | Medium | 5.9 | 2026-09-01 | A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive information via a man-in-the-middle attack. Succ… |
CVE-2026-73743 | Low | 3.7 | 2026-09-01 | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to gain insight into som… |
CVE-2026-55860 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/R2DBC is a non-blocking MariaDB and MySQL client implemented in Java. Prior to 1.4.1, org.mariadb:r2dbc-mariadb does not gate clear-text pass… |
CVE-2026-55857 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, PAM dialog auth… |
CVE-2026-55854 | Medium | 5.9 | 2026-08-28 | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB… |
CVE-2026-81836 | Low | 3.7 | 2026-08-28 | A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of… |
CVE-2026-73809 | High | 7.5 | 2026-08-28 | A cleartext transmission of sensitive information vulnerability exists
in certain Ebyte gateway products. The web management interface does not
adequately pr… |
CVE-2026-69658 | Critical | 9.8 | 2026-08-28 | MQTT credentials and control traffic are transmitted in cleartext,
exposing sensitive information to network-level attackers. This may
enable unauthorized de… |
CVE-2026-81691 | High | 7.5 | 2026-08-27 | openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigu… |
CVE-2026-19854 | Medium | 6.1 | 2026-08-27 | When the ClickHouse plugin uses Native protocol (the default) with PDC or secure SOCKS, it asks for TLS but the connection library ignores that and talks to Cl… |
CVE-2026-29988 | High | 7.6 | 2026-08-26 | A cleartext transmission of sensitive information vulnerability in the NFC interface of multiple Milesight IoT device models running affected firmware versions… |
CVE-2026-79782 | Low | 3.1 | 2026-08-25 | rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can inter… |
CVE-2026-79779 | Medium | 5.3 | 2026-08-25 | rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over pl… |
CVE-2026-77131 | | | 2026-08-25 | When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the at… |
CVE-2026-12556 | | | 2026-08-24 | Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead t… |
CVE-2026-19683 | High | 7.4 | 2026-08-20 | A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication… |
CVE-2026-22306 | Critical | 10.0 | 2026-08-19 | Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext
transmission of sensitive information vulner… |
CVE-2026-76244 | | | 2026-08-19 | stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loop… |
CVE-2026-15806 | | | 2026-08-18 | The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not tak… |
CVE-2026-20294 | Medium | 6.5 | 2026-08-05 | A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive informat… |
CVE-2026-18536 | High | 7.5 | 2026-08-01 | Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP.
The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource… |
CVE-2026-64742 | Medium | 6.5 | 2026-07-27 | This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 2… |
CVE-2026-3182 | Medium | 4.3 | 2026-07-21 | Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability. |
CVE-2026-47255 | High | 8.2 | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had… |
CVE-2026-48022 | Medium | 6.5 | 2026-07-17 | @hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before followi… |
CVE-2026-48978 | | | 2026-07-17 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge with… |
CVE-2026-34346 | Medium | 5.5 | 2026-07-14 | Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally. |
CVE-2026-53624 | Medium | 4.8 | 2026-07-08 | Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-… |
CVE-2025-36336 | Medium | 5.9 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 transmits data in clear text that could allow an attacker to obtain sensitive information using man in… |
CVE-2025-12530 | Medium | 5.9 | 2026-06-30 | IBM watsonx.data intelligence 5.2.2, 5.3.0, 5.3.1, 5.3.1 through Patch 1 transmits data in clear text that could allow an attacker to obtain sensitive informat… |
CVE-2026-55844 | High | 7.5 | 2026-06-29 | Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID all… |
CVE-2026-49486 | High | 7.5 | 2026-06-26 | The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was… |
CVE-2026-44726 | High | 7.4 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.0.0 until 2.7.8, a flaw in Deno's Node.js tls compatibility layer could cause a TLS client to… |
CVE-2026-55568 | Medium | 5.9 | 2026-06-23 | Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the proxy is transmi… |
CVE-2025-15619 | Low | 3.5 | 2026-06-23 | HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario. |
CVE-2026-11833 | | | 2026-06-23 | Overview:
A vulnerability has been found in FAST/TOOLS and CI Server. The web server may return a response containing the CI Server setting information. This… |
CVE-2026-50034 | Medium | 6.5 | 2026-06-19 | An attacker within BLE communication range can passively intercept
wireless traffic and obtain sensitive health-related information,
including glucose measur… |
CVE-2026-50200 | High | 7.5 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Management.Endpoint pr… |
CVE-2026-9741 | Medium | 6.5 | 2026-06-09 | A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryption (CSFLE) results… |
CVE-2026-45432 | | | 2026-06-04 | This vulnerability exists in GX Earth ONT models due to the transmission of user credentials in plaintext over HTTP in its web management interface. A remote a… |
CVE-2026-8874 | High | 7.1 | 2026-06-03 | Version 3.0.7 of the Securly Chrome Extension downloads JSON files containing crisis alert keywords and filtering rules over unencrypted HTTP via the Fetch API… |
CVE-2026-36610 | Medium | 5.9 | 2026-06-03 | Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding. The firmware contains no TLS… |
CVE-2026-7666 | Low | 3.1 | 2026-06-03 | An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.
`django.core.mail.backends.smtp.EmailBackend` in Django fails to prevent reuse of a p… |
CVE-2023-52951 | Medium | 5.9 | 2026-06-03 | A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain u… |
CVE-2026-10584 | Medium | 5.9 | 2026-06-02 | Proxy server in Graph Explorer before 3.0.1 falls back to HTTP when certificate files are missing, which might allow remote threat actors to obtain sensitive i… |
CVE-2026-43625 | Medium | 5.9 | 2026-06-01 | CodexBar prior to 0.32.0 contains a session cookie leakage vulnerability that allows network attackers to intercept imported browser session cookies by exploit… |
CVE-2026-25599 | Medium | 6.3 | 2026-06-01 | Missing authentication and clear‑text transmission of data from the heat pumps to the control server, combined with the absence of input validation on aggregat… |
CVE-2026-34126 | High | 7.5 | 2026-05-28 | TP-Link has identified a vulnerability in Tapo L535E v1.0 and v3.0, Tapo P300 v1.0, and Tapo D100C v1.0, where Bluetooth communication during the initial setup… |
CVE-2024-47269 | Medium | 4.9 | 2026-05-27 | Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 al… |
CVE-2026-48902 | Critical | 9.8 | 2026-05-26 | The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set. |
CVE-2026-24212 | High | 7.5 | 2026-05-26 | NVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive information is transmitted in clear text. A successful exploit of this vulnerability… |
CVE-2026-25608 | | | 2026-05-22 | STER uses unencrypted TCP traffic to transmit data over the network. It allows an attacker to conduct a Man-In-The-Middle attack and obtain sensitive data such… |
CVE-2026-38740 | Medium | 5.3 | 2026-05-14 | Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information. The device transmits sensitive Session Descript… |