CWE-522 · Insufficiently Protected Credentials (page 2)
Page 2 of 15 — CVEs classified under CWE-522, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39462 | High | 8.1 | 2026-04-24 | A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied due to improper handling of credential… |
CVE-2026-41345 | Medium | 5.3 | 2026-04-23 | OpenClaw before 2026.3.31 contains a credential exposure vulnerability in media download functionality that forwards Authorization headers across cross-origin… |
CVE-2026-41266 | High | 7.5 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive… |
CVE-2026-6408 | Low | 2.7 | 2026-04-22 | Tanium addressed an information disclosure vulnerability in Tanium Server. |
CVE-2025-36568 | High | 7.8 | 2026-04-17 | Dell PowerProtect Data Domain BoostFS for client of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 rel… |
CVE-2025-15622 | | 2026-04-17 | Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop c… | |
CVE-2025-15621 | | 2026-04-16 | Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during Ope… | |
CVE-2026-40173 | Critical | 9.4 | 2026-04-15 | Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debu… |
CVE-2026-32171 | High | 8.8 | 2026-04-14 | Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network. |
CVE-2026-27316 | Low | 2.7 | 2026-04-14 | A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 throu… |
CVE-2026-22576 | Medium | 4.3 | 2026-04-14 | A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7… |
CVE-2026-22574 | Medium | 4.1 | 2026-04-14 | A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7… |
CVE-2026-34262 | Medium | 5.0 | 2026-04-14 | Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer |
CVE-2026-35185 | High | 7.5 | 2026-04-06 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive… |
CVE-2026-35467 | High | 7.5 | 2026-04-02 | The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryp… |
CVE-2026-4819 | Medium | 4.9 | 2026-03-31 | In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana. |
CVE-2026-29872 | High | 8.2 | 2026-03-30 | A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19). Th… |
CVE-2026-33575 | High | 7.5 | 2026-03-29 | OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Att… |
CVE-2025-15617 | Medium | 6.5 | 2026-03-27 | Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded ar… |
CVE-2025-13478 | | 2026-03-27 | Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to obtain another user's session data via… | |
CVE-2026-33182 | High | 7.5 | 2026-03-26 | Saloon is a PHP library that gives users tools to build API integrations and SDKs. Prior to version 4.0.0, when building the request URL, Saloon combined the c… |
CVE-2025-36440 | Medium | 5.1 | 2026-03-25 | IBM Concert 1.0.0 through 2.2.0 could allow a local user to obtain sensitive information due to missing function level access control. |
CVE-2025-14790 | Medium | 6.5 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an attacker to obtain sensitive information due to insufficiently protected credentials. |
CVE-2025-64998 | High | 7.2 | 2026-03-24 | Exposure of session signing secret in Checkmk <2.4.0p23, <2.3.0p45 and 2.2.0 allows an administrator of a remote site with config sync enabled to hijack sessio… |
CVE-2026-32913 | Critical | 9.3 | 2026-03-23 | OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-ori… |
CVE-2026-31926 | Medium | 6.5 | 2026-03-20 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-28204 | Medium | 6.5 | 2026-03-20 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-23658 | High | 8.6 | 2026-03-19 | Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-32634 | High | 8.1 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, Glances stores both the Zeroconf-advertised s… |
CVE-2026-32633 | Critical | 9.1 | 2026-03-18 | Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.2, in Central Browser mode, the `/api/4/serverslist` endpoint returns raw… |
CVE-2026-32606 | High | 7.6 | 2026-03-18 | IncusOS is an immutable OS image dedicated to running Incus. Prior to 202603142010, the default configuration of systemd-cryptenroll as used by IncusOS through… |
CVE-2026-21670 | High | 7.7 | 2026-03-12 | A vulnerability allowing a low-privileged user to extract saved SSH credentials. |
CVE-2026-3783 | Medium | 5.3 | 2026-03-11 | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a redirect to a second URL, curl could leak that token to the second ho… |
CVE-2026-27777 | Medium | 6.5 | 2026-03-06 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-27027 | Medium | 6.5 | 2026-03-06 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-28714 | Medium | 4.8 | 2026-03-06 | Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186. |
CVE-2026-27770 | Medium | 6.5 | 2026-03-06 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-30796 | High | 7.5 | 2026-03-05 | Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windo… |
CVE-2026-29128 | Critical | 10.0 | 2026-03-05 | IDC SFX2100 Satellite Receiver firmware ships with multiple daemon configuration files for routing components (e.g., zebra, bgpd, ospfd, and ripd) that are own… |
CVE-2026-0689 | Medium | 4.9 | 2026-03-02 | In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an authenticated NAC administrator to retr… |
CVE-2026-20435 | Medium | 4.6 | 2026-03-02 | In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local information disclosure, if an attacker has p… |
CVE-2026-27167 | Unrated | | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Starting in version 4.16.0 and prior to version 6.6.0, Gradio applications running outs… |
CVE-2026-21660 | Critical | 9.8 | 2026-02-27 | Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22… |
CVE-2026-25774 | Medium | 6.5 | 2026-02-27 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-22878 | Medium | 6.5 | 2026-02-27 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-27773 | Medium | 6.5 | 2026-02-27 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-22890 | Medium | 6.5 | 2026-02-27 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-20791 | Medium | 6.5 | 2026-02-27 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2026-20733 | Medium | 6.5 | 2026-02-27 | Charging station authentication identifiers are publicly accessible via web-based mapping platforms. |
CVE-2025-67860 | Low | 3.8 | 2026-02-25 | A vulnerability has been identified in the NeuVector scanner where the scanner process accepts registry and controller credentials as command-line arguments, p… |
CVE-2026-26049 | Medium | 5.7 | 2026-02-20 | The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access t… |
CVE-2026-27003 | Medium | 5.5 | 2026-02-20 | OpenClaw is a personal AI assistant. Telegram bot tokens can appear in error messages and stack traces (for example, when request URLs include `https://api.tel… |
CVE-2026-25631 | Medium | 6.5 | 2026-02-06 | n8n is an open source workflow automation platform. Prior to 1.121.0, there is a vulnerability in the HTTP Request node's credential domain validation allowed… |
CVE-2026-0715 | Medium | 6.8 | 2026-02-05 | Moxa Arm-based industrial computers running Moxa Industrial Linux Secure use a device-unique bootloader password provided on the device. An attacker with physi… |
CVE-2026-1966 | | 2026-02-05 | YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI. An authenticated user with access to the configuration v… | |
CVE-2020-37097 | High | 7.5 | 2026-02-03 | Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details through the wlencrypt_wiz.asp file. Att… |
CVE-2025-52623 | Low | 3.7 | 2026-02-03 | HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead… |
CVE-2026-24845 | Medium | 6.5 | 2026-01-29 | malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.10.0 and prior to version 1.20.3, malcon… |
CVE-2020-36968 | Medium | 6.5 | 2026-01-28 | M/Monit 3.7.4 contains an authentication vulnerability that allows authenticated attackers to retrieve user password hashes through an administrative API endpo… |
CVE-2025-9521 | Medium | 6.5 | 2026-01-26 | Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypass secondary verification, and change t… |
CVE-2025-65098 | High | 7.4 | 2026-01-22 | Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows stealing all stored credentials from any… |
CVE-2026-23958 | Critical | 9.8 | 2026-01-22 | Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing sec… |
CVE-2026-21852 | High | 7.5 | 2026-01-21 | Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate d… |
CVE-2025-58742 | Medium | 5.9 | 2026-01-20 | Insufficiently Protected Credentials, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Connection Settings dialog in Mi… |
CVE-2025-58741 | High | 7.5 | 2026-01-20 | Insufficiently Protected Credentials vulnerability in the Credential Field of Milner ImageDirector Capture allows retrieval of credential material and enables… |
CVE-2026-1223 | Medium | 4.9 | 2026-01-20 | PrismX MX100 AP controller developed by BROWAN COMMUNICATIONS has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers t… |
CVE-2026-23742 | High | 8.8 | 2026-01-16 | Skipper is an HTTP router and reverse proxy for service composition. The default skipper configuration before 0.23.0 was -lua-sources=inline,file. The problem… |
CVE-2021-47759 | Medium | 6.2 | 2026-01-15 | MTPutty 1.0.1.21 contains a sensitive information disclosure vulnerability that allows local attackers to view SSH connection passwords through Windows PowerSh… |
CVE-2026-22911 | Medium | 5.3 | 2026-01-15 | Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access t… |
CVE-2026-22240 | High | 7.5 | 2026-01-14 | The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated re… |
CVE-2025-69271 | High | 7.5 | 2026-01-12 | Insufficiently Protected Credentials vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Sniffing Attacks.This issue affects DX NetOps Spectr… |
CVE-2026-22043 | Critical | 9.8 | 2026-01-08 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 through 1.0.0-alpha.78, a flawed `deny_only` short-circuit in RustFS IA… |
CVE-2025-62327 | Medium | 4.9 | 2026-01-07 | In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing auth… |
CVE-2025-67732 | Medium | 6.5 | 2026-01-05 | Dify is an open-source LLM app development platform. Prior to version 1.11.0, the API key is exposed in plaintext to the frontend, allowing non-administrator u… |
CVE-2025-64420 | Critical | 9.9 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434… |
CVE-2025-64122 | Medium | 5.5 | 2026-01-02 | Insufficiently Protected Credentials vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Signature Spoofing by Key Theft.This issue affects Mu… |
CVE-2021-47741 | High | 7.5 | 2025-12-31 | ZBL EPON ONU Broadband Router V100R001 contains a privilege escalation vulnerability that allows limited administrative users to elevate access by sending requ… |
CVE-2021-47726 | High | 7.5 | 2025-12-31 | NuCom 11N Wireless Router 5.07.90 contains a privilege escalation vulnerability that allows non-privileged users to access administrative credentials through t… |
CVE-2025-15113 | Critical | 9.3 | 2025-12-30 | Ksenia Security lares (legacy model) Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload M… |
CVE-2025-66029 | High | 7.6 | 2025-12-17 | Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin serve… |
CVE-2025-14148 | Medium | 6.5 | 2025-12-15 | IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 could allow an authenticated user with LLM integration configuration privileges to recover a previously saved L… |
CVE-2025-58130 | Critical | 9.1 | 2025-12-12 | Insufficiently Protected Credentials vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12… |
CVE-2020-36896 | High | 7.5 | 2025-12-10 | QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthenticated attackers to access administrative login info… |
CVE-2025-64898 | Medium | 5.3 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited una… |
CVE-2025-63361 | Medium | 5.7 | 2025-12-04 | Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to render the… |
CVE-2025-13758 | Low | 3.5 | 2025-11-27 | Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8. |
CVE-2025-13164 | Medium | 4.9 | 2025-11-17 | EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext credential… |
CVE-2025-13163 | Medium | 4.9 | 2025-11-17 | EasyFlow GP developed by Digiwin has an Insufficiently Protected Credentials vulnerability, allowing privileged remote attackers to obtain plaintext database a… |
CVE-2025-13187 | Medium | 5.3 | 2025-11-14 | A security vulnerability has been detected in Intelbras ICIP 2.0.20. Affected is an unknown function of the file /xml/sistema/acessodeusuario.xml. Such manipul… |
CVE-2025-36096 | Critical | 9.0 | 2025-11-13 | IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access… |
CVE-2025-6571 | Medium | 6.0 | 2025-11-11 | A 3rd-party component exposed its password in process arguments, allowing for low-privileged users to access it. |
CVE-2025-42897 | Medium | 5.3 | 2025-11-11 | Due to information disclosure vulnerability in anonymous API provided by SAP Business One (SLD), an attacker with normal user access could gain access to unaut… |
CVE-2025-12636 | Medium | 6.5 | 2025-11-06 | The Ubia camera ecosystem fails to adequately secure API credentials, potentially enabling an attacker to connect to backend services. The attacker would the… |
CVE-2025-54863 | Critical | 10.0 | 2025-11-04 | Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely… |
CVE-2025-34270 | Medium | 4.9 | 2025-10-30 | Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fails to obfuscate the password field dur… |
CVE-2025-12461 | | 2025-10-29 | This vulnerability allows an attacker to access parts of the application that are not protected by any type of access control. The attacker could access this… | |
CVE-2025-62794 | Low | 3.8 | 2025-10-28 | GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security. Before 0.0.7, any provided Git… |
CVE-2025-61482 | High | 7.2 | 2025-10-27 | Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root access to bypass two… |
CVE-2025-54808 | High | 7.8 | 2025-10-23 | Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory… |
CVE-2024-42192 | Medium | 5.5 | 2025-10-16 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage which could allow an attacker to access other computers or applications. |