CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
A kind of CWE-311 Missing Encryption of Sensitive Data.
From the CWE List. © The MITRE Corporation.
Newest
- chartbrew Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage 7.5 High
- tinyhumansai openhuman OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response) 8.8 High
- eclipse foundation basyx helm charts Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts 7.5 High
- eclipse foundation basyx helm charts Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts 7.5 High
- mailenable MailEnable Auth Cleartext Storage Information Disclosure Vulnerability 5.9 Medium
- devolutions server Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3... 7.5 High
- No product listed Konflux-ci: github token plaintext exposure in ci/cd scripts 8.6 High
- ibm langflow oss, langflow +1 more Langflow OSS is affected by multiple vulnerabilities 6.5 Medium
- mlflow MLflow CrewAI autologging records LLM provider API keys in logged trace spans 6.5 Medium
- boneio Cleartext Storage of Sensitive Information in boneIO 6.9 Medium
- crawlseo crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens 6.7 Medium
- watchguard agent Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File 6.9 Medium
- newtype infortech nt oneapp NewType Infortech｜NT OneAPP - Exposure of Sensitive Information 6.7 Medium
- wso2 api control plane, api manager, carbon identity api server configs v1 +5 more +7 more Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials 4.9 Medium
- soarkey studentmanagement Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage 4.8 Medium
- geo corporation "ゲオアプリ" for android, "ゲオアプリ" for ios +1 more "ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive... 5.1 Medium
- siderolabs talos Talos Linux: Support bundle does not redact registry credentials 3.3 Low
- super-productivity Super Productivity: SuperSync E2EE setup uploads and stores all user operations in plaintext before password is set 5.7 Medium
- weebzone telegram-stremio Telegram-Stremio 5.1.0 Insecure Session Storage via encode_string 8.2 High
- flyteorg flyte Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook 7.1 High
- go-vikunja vikunja Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access 8.1 High
- dongdongbh mindwtr Mindwtr: Cloud token and WebDAV password stored in plaintext on mobile 4.4 Medium
- nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: Node Secret Credential Exposure via URL Query Parameter 8.8 High
- tp-link system inc. tapo s505 v1.6 Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware 5.4 Medium
- geovision inc. gv-eye GV-Eye Relay Payment API Key Vulnerability 7.5 High
- geovision inc. gv-eye GV-Eye Hardcoded API Key Vulnerability 7.5 High
- devolutions server Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and... 7.2 High
- heymrun heym heym before 0.0.91 Multiple Secrets Plaintext Storage 6.9 Medium
- openclaw OpenClaw iOS before 2026.8.11 Credential Storage via Share Extension 6.8 Medium
- zammad Zammad: Sensitive Information Exposure in Integration Administration API 6.9 Medium
-
jetty12Debian,jetty9Debian,org.eclipse.jetty:apache-jspTuxCare +126 more +128 more TuxCare security update for 123 packages (8 CVEs) 5.6 Medium - sfturing hosp order sfturing hosp_order CommonUserServiceImpl.java cleartext storage 4.8 Medium
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 more MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions 6.1 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login 8.2 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 more RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords 5.9 Medium
- mongodb mongoid Silent plaintext persistence via unresolved callable database name in encryption schema map 7.1 High
- mongodb mongoid Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation 7.1 High
- anycable AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets 5.9 Medium
- carecam hmt.cm2507 firmware CareCam CM2507 Cleartext Storage of Sensitive Information 9.3 Critical
- suse observability Service token exposure and potential privilege escalation in SUSE Observability 5.7 Medium
- fermax electronica s.a.u. duoxme Cleartext Storage of Sensitive Information Vulnerability 6.9 Medium
- No product listed MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in... 4.6 Medium
- No product listed DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive... 7.6 High
- go-vikunja vikunja Vikunja before 2.6.0 TOTP Secret Disclosure via API 5.3 Medium
- codeastro blood donor management system PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file 6.3 Medium
- ni systemlink, systemlink server +1 more Storage of Sensitive Information in Cleartext in NI SystemLink 8.4 High
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 more Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior... 5.5 Medium
- sourcecodester syllabus-aligned learning management & examination system SourceCodester Syllabus-Aligned Learning Management & Examination System cict_portal.sql cleartext storage 6.9 Medium
- arubanetworks fabric composer Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer 2.2 Low
- aws sagemaker-python-sdk Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path 8.5 High
- Show olderLoading…