CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
A kind of CWE-669 Incorrect Resource Transfer Between Spheres.
From the CWE List. © The MITRE Corporation.
Newest
- rustls Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debug 4.1 Medium
- undici undici vulnerable to cross-origin credential disclosure via array-of-tuples headers bypassing redirect stripping 5.9 Medium
- No product listed CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig 4.9 Medium
- openbao OpenBao 2.2.0 before 2.6.4 and 2.7.0 before 2.7.1 ACME EAB MAC Key Disclosure via Sanitized Configuration 2.1 Low
- follow-redirects follow-redirects array-form headers bypass cross-origin credential stripping 8.2 High
- nezhahq nezha Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint 7.1 High
-
rustlscrates.io Rustls: Session Debug formatting exposes TLS master secrets and resumption PSKs 4.0 Medium - pydantic ai, pydantic-ai, pydantic-ai-slim +2 more Pydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False` 2.3 Low
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 more Pydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False` 2.3 Low
- the wikimedia foundation mediawiki - flaggedrevs extension "Checked by" label in page history should not be shown if the underlying review log entry is suppressed" 6.9 Medium
- ibm powervm hypervisor, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +24 more +26 more This Power System update is being released to address 3.4 Low
- canva The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an... 7.1 High
- hcl software devops deploy / hcl launch, hclsoftware hcl devops deploy / hcl launch +1 more HCL DevOps Deploy / HCL Launch is susceptible to an Improper Removal of Sensitive Information Before Storage or Transfer 6.5 Medium
- arista networks eos Security Advisory 0178 2.3 Low
- grokability snipe-it Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains 5.1 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 more Improper Redaction of Query Literals in MongoDB Server Query Statistics Serialization on Sharded Cluster Router 5.1 Medium
- ibm ucd - ibm devops deploy, ucd - ibm urbancode deploy +1 more IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an information disclosure vulnerability 6.5 Medium
- canva The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin... 8.8 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +5 more +7 more .NET Information Disclosure Vulnerability 5.9 Medium
- canonical ubuntu 16.04 lts, ubuntu 18.04 lts, ubuntu 20.04 lts +3 more +5 more AppArmor Base Profile Misconfiguration in snapd Permits Confined Snaps Unauthorized Access to Hashed Passwords via systemd-userdbd 5.6 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +2 more +4 more Kronosnet: kronosnet: encryption key exposure in memory after cryptographic configuration changes 5.8 Medium
- guzzle guzzlehttp/guzzle before 7.15.1 URI Fragment Disclosure via Referer 8.2 High
- redhat build of keycloak, red hat build of keycloak 26.6, build of keycloak 26.6.7 +3 more +5 more Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins 4.3 Medium
- forgekeep nebula-mesh nebula-mesh: CA private key not zeroized on web mobile-bundle error paths 7.1 High
- openstack ironic OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume properties 6.8 Medium
- bludit Bludit's persistent authentication tokens not revoked upon account disablement 7.1 High
- No product listed The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic... 4.6 Medium
- argoproj argo cd, argo-cd +1 more Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations 6.3 Medium
- safedep gryph Gryph Agents Payload Filter Fails to Strip Tool Payload for Sensitive Content 5.5 Medium
- neorazorx facturascripts FacturaScripts: Unstripped Image Metadata (EXIF) Leakage via Library Module File Upload/Download 6.5 Medium
- phoenix contact fl mguard 2102, fl mguard 2105, fl mguard 4102 pci +70 more +72 more Phoenix Contact: Improper removal of sensitive information in MGUARD products 8.0 High
- openbao OpenBao's Namespace Deletion May Not Delete Data Properly 2.3 Low
- argoproj argo cd, argo-cd, red hat openshift data foundation 4 +3 more +5 more ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction 9.6 Critical
- argoproj argo cd, red hat openshift data foundation 4, openshift gitops +2 more In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext... 7.7 High
- openclaw OpenClaw < 2026.4.14 - Redaction Bypass via sourceConfig and runtimeConfig Aliases 7.1 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 more Windows Recovery Environment Security Feature Bypass Vulnerability 4.6 Medium
- follow-redirects, red hat cluster observability operator 1.5.0, cryostat 4 +79 more +81 more follow-redirects: Custom Authentication Headers Leaked to Cross-Domain Redirect Targets 6.9 Medium
- the wikimedia foundation mediawiki - centralauth extension Global vanishing does not completely remove user email 8.8 High
- openclaw OpenClaw < 2026.3.31 - Unsanitized Environment Variable Leakage in SSH Sandbox Backends 2.0 Low
- trino Trino: Iceberg REST catalog static and vended credentials are accessible via query JSON 7.7 High
- openclaw OpenClaw < 2026.3.22 - Credential Exposure via baseUrl Fields in Gateway Snapshots 7.1 High
- openvessl anchorr Anchorr Privilege Escalation: Jellyseerr User → Anchorr Admin via Stored XSS 9.1 Critical
- gitlab Improper Removal of Sensitive Information Before Storage or Transfer in GitLab 4.3 Medium
- gitlab Improper Removal of Sensitive Information Before Storage or Transfer in GitLab 4.3 Medium
- oocx tfplan2md tfplan2md has Sensitive Value Exposure in Generated Reports 8.5 High
- coollabs coolify Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint 5.7 Medium
- agronholm cbor2 CBORDecoder reuse can leak shareable values across decode calls 5.5 Medium
- m-files server Unintended temporary cached data included in a structure only copy intended to be empty of data 5.6 Medium
- checkmk Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule 2.3 Low
- anchore grype Grype has a credential disclosure vulnerability in Grype JSON output 8.2 High
- Show olderLoading…