CWE-312 Cleartext Storage of Sensitive Information
Description
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-312 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-7cxh-94cf-mfp6 | CVE-2026-77564 | LOW |
Talos Linux: Support bundle does not redact registry credentials |
2026-10-15 | |
| GHSA-88f6-4rjv-x774 | CVE-2026-91982 | MODERATE |
Vikunja: TOTP secret is readable after enrollment, no step-up auth |
2026-10-09 | |
| GHSA-r6w9-259g-gwrv | CVE-2026-62376 | HIGH |
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access |
2026-10-09 | |
| GHSA-pvgv-gcp7-v38g | CVE-2026-107807 | HIGH |
Nginx UI: Node Secret Credential Exposure via URL Query Parameter |
2026-10-09 | |
| GHSA-f3c2-j7g8-vpp8 | CVE-2026-68970 | MODERATE |
Apache Airflow Task SDK fails to mask list-shaped JSON Variables |
2026-10-02 | |
| GHSA-f643-3rc2-j27w | CVE-2026-59244 | MODERATE |
Apache Airflow exposes dict-valued var.json secrets in Rendered Templates |
2026-10-02 | |
| GHSA-8qr4-27mh-hqfr | CVE-2026-57287 | MODERATE |
Jenkins Job Configuration History Plugin doesn't redact encrypted values of secrets in job and agent configurations |
2026-09-25 | |
| GHSA-g5xv-mhgm-v5f6 | CVE-2026-77250 | MODERATE |
MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions |
2026-09-22 | |
| GHSA-w72w-9qmj-c9qm | CVE-2026-63406 | MODERATE |
AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets |
2026-09-18 | |
| GHSA-wg65-39gg-5wfj | CVE-2026-42151 | HIGH |
Prometheus Azure AD remote write OAuth client secret exposed via config API |
2026-09-09 | |
| GHSA-2mc4-j865-9q4r | CVE-2026-61798 | HIGH |
netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages |
2026-08-20 | |
| GHSA-9r8p-h6cc-6qhm | CVE-2026-65599 | MODERATE |
n8n: Google Service Account Private Key Exposed in JWT Header |
2026-07-22 | |
| GHSA-mhvh-gwhr-76pw | - | MODERATE |
Duplicate Advisory: Google Service Account Private Key Exposed in JWT Header |
2026-07-22 | |
| GHSA-q4vm-pq3q-8wgq | CVE-2026-53603 | HIGH |
nebula-mesh: Operator session tokens stored in plaintext in the database |
2026-07-14 | |
| GHSA-q9g8-9hpp-xc82 | CVE-2020-10727 | MODERATE |
ActiveMQ Artemis has Insufficiently Protected Credentials |
2026-07-07 | |
| GHSA-fhh2-gg7w-gwpq | CVE-2026-33026 | CRITICAL |
nginx-ui Backup Restore Allows Tampering with Encrypted Backups |
2026-07-06 | |
| GHSA-rxrh-4j9h-xgg9 | CVE-2026-50267 | MODERATE |
Steeltoe: TLS private keys written to /tmp with default permissions, never deleted |
2026-07-02 | |
| GHSA-6pcv-j4jx-m4vx | CVE-2026-56270 | MODERATE |
Flowise: Unauthenticated Information Disclosure of OAuth Secrets (Cleartext) via GET Request |
2026-06-24 | |
| GHSA-ghmh-jhmj-wcmf | - | MODERATE |
nebula-mesh's stores enrollment tokens unhashed in SQLite |
2026-06-22 | |
| GHSA-2f86-9cp8-6hcf | CVE-2026-55885 | MODERATE | - |
Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets |
2026-06-18 |
| GHSA-7hh5-prp2-mfh5 | CVE-2026-8596 | HIGH |
Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK ModelBuilder/Serve path |
2026-05-21 | |
| GHSA-3q27-7qjq-p9c5 | CVE-2026-27877 | MODERATE |
Grafana public dashboards disclose all direct mode datasources |
2026-05-13 | |
| GHSA-gj49-89wh-h4gj | CVE-2026-41520 | HIGH |
Cillium exposes sensitive information included in the cilium-bugtool debug archive |
2026-05-13 | |
| GHSA-8f47-4rh3-x44m | CVE-2026-8026 | MODERATE |
Flowise: Bcrypt Password Hash Exposure |
2026-05-12 | |
| GHSA-37j4-88rp-2f6h | CVE-2026-43942 | MODERATE |
Electerm's full process.env exposed to renderer via window.pre.env |
2026-05-08 |