CWE-922 Insecure Storage of Sensitive Information

HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack

Logging of the firestore key within nodejs-firestore

kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token

Openshift Hive Exposes VCenter Credentials via ClusterProvision

EVE Doesn't Protect Config Partition with Measured Boot

EVE's Debug Functions Unlockable Without Triggering Measured Boot

EVE: SSH as Root Unlockable Without Triggering Measured Boot

Weblate wlc has insecure API key configuration

Spoofing attack in swagger-ui

MantisBT Insecure Storage in manage_proj_edit_page.php

Missing permission checks on Hazelcast client protocol

Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials

Apache StreamPark: Information leakage vulnerability

RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring

Moodle admin presets export tool includes some secrets that should not be exported

Apache Camel data exposure vulnerability

scikit-learn sensitive data leakage vulnerability

rke's credentials are stored in the RKE1 Cluster state ConfigMap

Apache Solr's Streaming Expressions allow users to extract data from other Solr Clouds

Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)

Secret file credentials stored unencrypted in rare cases by Plain Credentials Plugin

vantage6 may create unencrypted tasks in encrypted collaboration

RosarioSIS Stores Sensitive Data in a Mechanism without Access Control

Publify Core does not strip metadata from images

ezplatform-graphql GraphQL queries can expose password hashes