CVE-2025-59320 | Medium | 4.6 | 2026-08-12 | CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 stores TPM2.0 secrets in a serialized format within unused disk sectors. An unauthenticated attacker wit… |
CVE-2026-20705 | | | 2026-08-11 | Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Domain may allow information disclosure. S… |
CVE-2026-47362 | Medium | 4.6 | 2026-08-07 | In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDat… |
CVE-2026-46511 | | | 2026-06-05 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token expo… |
CVE-2026-5515 | Medium | 5.5 | 2026-05-27 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2025-32751 | Medium | 5.5 | 2026-05-22 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with local access… |
CVE-2025-32746 | Medium | 4.0 | 2026-05-22 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. An unauthenticated attacker with local acces… |
CVE-2026-7257 | Medium | 4.4 | 2026-05-12 | ** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 firmware version V1.00… |
CVE-2026-40868 | High | 8.1 | 2026-04-21 | Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Autho… |
CVE-2026-26152 | High | 7.0 | 2026-04-14 | Insecure storage of sensitive information in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-5666 | Medium | 5.3 | 2026-04-06 | A vulnerability was detected in code-projects Online FIR System 1.0. Affected by this issue is some unknown functionality of the file /complaints.sql of the co… |
CVE-2026-5650 | Medium | 5.3 | 2026-04-06 | A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sq… |
CVE-2026-33407 | Critical | 9.1 | 2026-03-24 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.7.0, Wallos endpoints/logos/search.php accepts HTTP_PROXY and HTTPS_P… |
CVE-2025-10734 | Medium | 5.3 | 2026-03-23 | The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive I… |
CVE-2026-20629 | Medium | 5.5 | 2026-02-11 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access user-sensitive d… |
CVE-2025-10464 | Medium | 6.5 | 2026-02-09 | Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensi… |
CVE-2025-70963 | High | 7.6 | 2026-02-06 | Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HT… |
CVE-2025-14376 | | | 2026-01-20 | A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext secrets stored in environment variables on t… |
CVE-2025-10971 | | | 2025-12-02 | Insecure Storage of Sensitive Information vulnerability in MeetMe on iOS, Android allows Retrieve Embedded Sensitive Data. This issue affects MeetMe: through v… |
CVE-2025-12539 | Critical | 10.0 | 2025-11-11 | The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due… |
CVE-2025-61482 | High | 7.2 | 2025-10-27 | Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root access to bypass two… |
CVE-2025-60856 | Medium | 6.8 | 2025-10-20 | Reolink Video Doorbell WiFi DB_566128M5MP_W allows root shell access through an unsecured UART/serial console. An attacker with physical access can connect to… |
CVE-2025-11645 | Low | 2.4 | 2025-10-12 | A security vulnerability has been detected in Tomofun Furbo Mobile App up to 7.57.0a on Android. This affects an unknown part of the component Authentication T… |
CVE-2025-11644 | Low | 2.0 | 2025-10-12 | A weakness has been identified in Tomofun Furbo 360 and Furbo Mini. Affected by this issue is some unknown functionality of the component UART Interface. Execu… |
CVE-2025-11639 | Low | 3.3 | 2025-10-12 | A vulnerability has been found in Tomofun Furbo 360 and Furbo Mini. The impacted element is an unknown function of the file collect_logs.sh of the component De… |
CVE-2025-21045 | Medium | 4.0 | 2025-10-10 | Insecure storage of sensitive information in Galaxy Watch prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-35054 | Medium | 5.3 | 2025-10-09 | Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encr… |
CVE-2025-34189 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application versions prior to 20.0.1330 (macOS/Linux client deploymen… |
CVE-2025-43203 | Medium | 4.0 | 2025-09-15 | The issue was addressed with improved handling of caches. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26. An attacker with physical acce… |
CVE-2025-8699 | Critical | 9.1 | 2025-09-12 | Some "Stored Value" Unattended Payment Solutions of KioSoft use vulnerable NFC cards. Attackers could potentially use this vulnerability to change the balance… |
CVE-2025-54083 | | | 2025-09-09 | Insecure Storage of Sensitive Information vulnerability in Calix GigaCenter ONT (Quantenna SoC modules) allows admin access to the web interface.This issue aff… |
CVE-2025-21041 | Medium | 6.2 | 2025-09-03 | Insecure Storage of Sensitive Information in Secure Folder prior to Android 16 allows local attackers to access sensitive information. |
CVE-2025-53507 | Medium | 6.5 | 2025-08-29 | Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information vulnerability. If exploited, configuration information, such as… |
CVE-2025-25732 | Medium | 6.8 | 2025-08-26 | Incorrect access control in the EEPROM component of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units (RSUs) v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211… |
CVE-2025-46660 | Medium | 5.3 | 2025-08-06 | An issue was discovered in 4C Strategies Exonaut 21.6. Passwords, stored in the database, are hashed without a salt. |
CVE-2025-37110 | Medium | 6.0 | 2025-07-31 | A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrato… |
CVE-2025-28171 | Medium | 6.5 | 2025-07-29 | An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi. |
CVE-2025-28244 | High | 8.8 | 2025-07-10 | Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session tokens from localSt… |
CVE-2025-21003 | Medium | 4.0 | 2025-07-08 | Insecure storage of sensitive information in Emergency SOS prior to SMR Jul-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-42979 | Medium | 5.6 | 2025-07-08 | The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credential… |
CVE-2025-37100 | High | 7.7 | 2025-06-10 | A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users.
A successful exploit… |
CVE-2025-48929 | Medium | 4.0 | 2025-05-28 | The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token with a short expiration time) that can… |
CVE-2024-13954 | Medium | 6.5 | 2025-05-22 | Serialized configuration information may be disclosed during device commissioning while using ASPECT's configuration toolsetThis issue affects ASPECT-Enterpris… |
CVE-2025-45242 | High | 7.7 | 2025-05-05 | Rhymix v2.1.22 was discovered to contain an arbitrary file deletion vulnerability via the procFileAdminEditImage method in /file/file.admin.controller.php. |
CVE-2025-46627 | High | 8.2 | 2025-05-01 | Use of weak credentials in the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated attacker to authenticate to the telnet service by calculating the root passw… |
CVE-2025-2440 | Medium | 4.2 | 2025-04-09 | CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized
access of confidential data when a maliciou… |
CVE-2025-29809 | High | 7.1 | 2025-04-08 | Insecure storage of sensitive information in Windows Kerberos allows an authorized attacker to bypass a security feature locally. |
CVE-2025-20945 | Medium | 4.0 | 2025-04-08 | Improper access control in Galaxy Watch prior to SMR Apr-2025 Release 1 allows local attackers to access sensitive information of Galaxy watch. |
CVE-2025-2489 | | | 2025-03-18 | Insecure information storage vulnerability in NTFS Tools version 3.5.1. Exploitation of this vulnerability could allow an attacker to know the application pass… |
CVE-2025-2241 | High | 8.2 | 2025-03-17 | A flaw was found in Hive, a component of Multicluster Engine (MCE) and Advanced Cluster Management (ACM). This vulnerability causes VCenter credentials to be e… |
CVE-2025-2157 | Low | 3.3 | 2025-03-15 | A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, ex… |
CVE-2025-20912 | Medium | 6.2 | 2025-03-06 | Incorrect default permission in DiagMonAgent prior to SMR Mar-2025 Release 1 allows local attackers to access data within Galaxy Watch. |
CVE-2025-21098 | Medium | 5.5 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read bypass permission check. |
CVE-2025-22492 | Medium | 6.3 | 2025-02-28 | The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this
string can be used for gaining administrat… |
CVE-2024-12315 | High | 7.5 | 2025-02-12 | The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi… |
CVE-2025-20886 | Medium | 4.1 | 2025-02-04 | Inclusion of sensitive information in test code in softsim trustlet prior to SMR Jan-2025 Release 1 allows local privileged attackers to get test key. |
CVE-2024-57436 | High | 7.2 | 2025-01-29 | RuoYi v4.8.0 was discovered to allow unauthorized attackers to view the session ID of the admin in the system monitoring. This issue can allow attackers to imp… |
CVE-2024-57546 | High | 7.5 | 2025-01-27 | An issue in CMSimple v.5.16 allows a remote attacker to obtain sensitive information via a crafted script to the validate link function. |
CVE-2024-54728 | Medium | 6.5 | 2025-01-27 | Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs. |
CVE-2025-24117 | Medium | 5.5 | 2025-01-27 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3… |
CVE-2025-24101 | Medium | 5.5 | 2025-01-27 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.3. An app may be able to access user-sensiti… |
CVE-2024-54549 | Medium | 5.5 | 2025-01-27 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensiti… |
CVE-2024-54541 | Medium | 5.5 | 2025-01-27 | This issue was addressed through improved state management. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ven… |
CVE-2024-56972 | Medium | 6.5 | 2025-01-27 | An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56971 | Medium | 6.5 | 2025-01-27 | An issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive user information vi… |
CVE-2024-56969 | Medium | 6.5 | 2025-01-27 | An issue in Pixocial Technology (Singapore) Pte. Ltd BeautyPlus iOS 7.8.010 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56968 | Medium | 6.5 | 2025-01-27 | An issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user information via supplying a crafted payload. |
CVE-2024-56967 | Medium | 6.5 | 2025-01-27 | An issue in Cloud Whale Interactive Technology LLC. PolyBuzz iOS 2.0.20 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56966 | Medium | 6.5 | 2025-01-27 | An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitive user information… |
CVE-2024-56965 | Medium | 6.5 | 2025-01-27 | An issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via supplying a crafted lin… |
CVE-2024-56964 | Medium | 6.5 | 2025-01-27 | An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user information via supplyin… |
CVE-2024-56963 | Medium | 6.5 | 2025-01-27 | An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via supplying a crafted… |
CVE-2024-56962 | Medium | 6.5 | 2025-01-27 | An issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56960 | Medium | 6.5 | 2025-01-27 | An issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information via supplying a craf… |
CVE-2024-56959 | Medium | 6.5 | 2025-01-27 | An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56957 | Medium | 6.5 | 2025-01-27 | An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via supplying a crafted l… |
CVE-2024-56955 | Medium | 6.5 | 2025-01-27 | An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56954 | Medium | 6.5 | 2025-01-27 | An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information via supplying a craf… |
CVE-2024-56953 | Medium | 6.5 | 2025-01-27 | An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a crafted link. |
CVE-2024-56952 | Medium | 6.5 | 2025-01-27 | An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information via supplying a cr… |
CVE-2024-56951 | Medium | 6.5 | 2025-01-27 | An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56950 | Medium | 6.5 | 2025-01-27 | An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56949 | Medium | 6.5 | 2025-01-27 | An issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user information via supplying… |
CVE-2024-56948 | Medium | 6.5 | 2025-01-27 | An issue in KuGou Technology CO. LTD KuGou Music iOS v20.0.0 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56947 | Medium | 6.5 | 2025-01-27 | An issue in Xiamen Meitu Technology Co., Ltd. BeautyCam iOS v12.3.60 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-55931 | Medium | 6.5 | 2025-01-27 | Xerox Workplace Suite stores tokens in session storage, which may expose them to potential access if a user's session is compromised.
The patch for this vuln… |
CVE-2021-42718 | Medium | 4.9 | 2025-01-23 | Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access t… |
CVE-2025-21299 | High | 7.1 | 2025-01-14 | Windows Kerberos Security Feature Bypass Vulnerability |
CVE-2025-22984 | High | 7.5 | 2025-01-14 | An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information. |
CVE-2025-22983 | High | 7.5 | 2025-01-14 | An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information. |
CVE-2024-48883 | Medium | 4.3 | 2025-01-13 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480… |
CVE-2024-56113 | High | 7.5 | 2025-01-09 | Smart Toilet Lab - Motius 1.3.11 is running with debug mode turned on (DEBUG = True) and exposing sensitive information defined in Django settings file through… |
CVE-2024-53932 | Critical | 9.1 | 2025-01-06 | The com.remi.colorphone.callscreen.calltheme.callerscreen (aka Color Phone: Call Screen Theme) application through 21.1.9 for Android enables any application (… |
CVE-2024-53931 | Critical | 9.1 | 2025-01-06 | The com.glitter.caller.screen (aka iCaller, Caller Theme & Dialer) application through 1.1 for Android enables any application (with no permissions) to place p… |
CVE-2024-44298 | Low | 3.3 | 2024-12-20 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. An app may be able to access inf… |
CVE-2024-44292 | Medium | 5.5 | 2024-12-20 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.1. An app may be able to access sen… |
CVE-2024-49201 | Medium | 4.3 | 2024-12-18 | Keyfactor Remote File Orchestrator (aka remote-file-orchestrator) 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the… |
CVE-2024-4995 | Critical | 9.8 | 2024-12-18 | Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data int… |
CVE-2024-54504 | Medium | 5.5 | 2024-12-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.2. An app may be able to access use… |
CVE-2024-54485 | Low | 2.4 | 2024-12-12 | The issue was addressed by adding additional logic. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2. An attacker with physic… |