CWE-256
CVEs classified under CWE-256, newest first.
34 CVEsRSS
CVE-2026-110975High· 7.4Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure
A flaw was found in Kruize Autotune. Its REST API ships without an authentication layer, and the endpoints that return datasource configuration — the list-datasources endpoint (GET /datasources) and the datasource-metadata endpoint — ser…
CVE-2026-19864Medium· 5.6Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object
Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may c…
CVE-2026-63315High· 8.2WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext
WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account. This issue was fixed i…
CVE-2026-70414Medium· 5.5Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability
Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.
CVE-2026-104892High· 8.7Plane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed …
CVE-2026-84884High· 7.5IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format
IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticated attacker who gains access to the stored credential could recover the password and obtain an ad…
CVE-2026-67221Medium· 5.9RabbitMQ is a messaging and streaming broker
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw …
CVE-2026-77407High· 7.0RabbitMQ amqp091-go is a Go AMQP 0.9.1 client
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection…
CVE-2026-2380High· 7.4On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged
On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded o…
CVE-2026-46488Critical· 9.1PoCmotionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection
motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meye_username and meye_password_hash c…
CVE-2026-82783Medium· 4.2Plaintext storage of a password issue exists in CONPROSYS nano Series
Plaintext storage of a password issue exists in CONPROSYS nano Series . If this vulnerability is exploited, an attacker with physical access to the product may obtain credentials.
CVE-2026-89444High· 7.0platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer set_attribute() populates the security area of the BIOS attribute request buffer with the curre…
CVE-2026-19051High· 7.1Plaintext storage of a password vulnerability in Menulux Software Inc
Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue affects Menulux Portal: before 20260903211448.
CVE-2026-15933NoneOptimiDoc Server (On-Premise) stores credentials for external services in cleartext
OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user lis…
CVE-2026-82453High· 7.5rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.
CVE-2026-55765High· 8.5CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments
CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in `ALTER ROLE` and `CREATE ROLE` statements generated by Set…
CVE-2026-55164Medium· 4.9Lemur manages TLS certificate creation
Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hash_password only for the before_insert event. Be…
CVE-2026-50268Low· 1.9Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
CVE-2026-57302Medium· 4.3Jenkins FitNesse Plugin stores passwords unencrypted
Jenkins FitNesse Plugin stores passwords unencrypted
CVE-2024-39575High· 7.4update_disk_psu_baseline.sh requires password in plain text
update_disk_psu_baseline.sh requires password in plain text
CVE-2024-45636Medium· 4.1IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user.
IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user.
CVE-2026-42151High· 7.5Prometheus is an open-source monitoring system and time series database
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of…
CVE-2025-36335Medium· 6.2IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.3.0, 5.3.1 stores user credentials in plain text which can be read by a local user.
IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.3.0, 5.3.1 stores user credentials in plain text which can be read by a local user.
CVE-2025-15624High· 7.5Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd
Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local password…
CVE-2026-33216High· 8.6NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-auth…
CVE-2026-21660Critical· 9.8A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, an…
A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, an…
CVE-2025-15128Medium· 5.3A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2
A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint. Performing a manipulation of the argument backup_encryption_password_decrypt/…
CVE-2025-66910Medium· 6.0Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system
Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects to …
CVE-2024-42197Medium· 5.5HCL Workload Scheduler stores user credentials in plain text which can be read by a local user.
HCL Workload Scheduler stores user credentials in plain text which can be read by a local user.
CVE-2025-14183Medium· 4.3A vulnerability was found in SGAI Space1 NAS N1211DS up to 1.0.915
A vulnerability was found in SGAI Space1 NAS N1211DS up to 1.0.915. This issue affects the function GET_FACTORY_INFO/GET_USER_INFO of the file /cgi-bin/JSONAPI of the component gsaiagent. The manipulation results in unprotected storage o…