CWE-319: Cleartext Transmission vulnerabilities

CVE-2026-64893 is a vulnerability in Johnson Controls EasyIO NEO that allows cleartext transmission of sensitive information. This flaw affects versions before 3.3b25 and could enable a man-in-the-middle attack. The vulnerability has a high severity rating with a CVSS score of 7.3. No official patch or remediation details are provided in the available data.

CVE-2026-55396 is a high-severity vulnerability in Teledyne FLIR Aware2 software affecting PackBot and FirstLook robots. The issue involves cleartext transmission of sensitive operator control traffic over UDP without cryptographic integrity checks. This allows adjacent unauthenticated attackers to intercept, hijack, or modify control communications by sniffing or hijacking network traffic. The vulnerability affects versions up to 6.9.0.2 for PackBot and up to 1.7.9 for FirstLook. No patch or remediation information is provided in the available data.

Teledyne FLIR Aware2 versions up to 6.9.0.2 transmit sensitive session information over unencrypted 802.11 wireless networks. This allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic to Teledyne FLIR PackBot robots by sniffing or hijacking network communications. The vulnerability is classified under CWE-319 for cleartext transmission of sensitive information. The CVSS 4.0 base score is 5.3, indicating a medium severity risk.

CVE-2026-14984 is a critical vulnerability in Teledyne FLIR Aware2 up to version 6.9.0.2 that involves cleartext transmission of sensitive information. This flaw allows remote unauthenticated attackers to intercept, hijack, or modify session traffic to Teledyne FLIR PackBot robots by sniffing or hijacking network communications. The vulnerability affects primary control endpoints and poses a high risk to confidentiality, integrity, and availability of the affected systems.

Joyland.ai, an Android application, permits cleartext HTTP traffic on Android 9 and later versions, where the default behavior is to block such traffic. This vulnerability (CVE-2026-102670) is classified under CWE-319, indicating the cleartext transmission of sensitive information. The issue affects all versions of Joyland.ai. The CVSS 4.0 base score is 5.3, indicating a medium severity vulnerability with network attack vector and low complexity. No official patch or remediation information is provided, and no known exploits are reported in the wild.

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle (MitM) attacks.

Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attacker to eavesdrop on with authentication credentials and sensitive data in transit. This issue affects Hitachi Coding Software Suite: through 3.3.0.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

The Botslab G980H dash camera firmware transmits sensitive data such as recordings, live video, location, images, and logs over unencrypted HTTP and RTSP protocols. This allows an attacker on the same WiFi network to intercept and access this information. The vulnerability affects specific firmware versions of the device. No patch or official remediation is currently documented.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information.

Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subset of carriers that were connected to the affected MQTT broker.

IBM Controller versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 transmit sensitive information in clear text. This vulnerability could allow an attacker to intercept sensitive data using man-in-the-middle techniques. The CVSS score is 5.9, indicating a medium severity risk. No known exploits are reported in the wild. The vulnerability does not affect cloud services and no patch information is provided.

AsyncHttpClient versions from 2.0.0 up to but not including 2.16.1, and from 3.0.0 up to but not including 3.0.12, have a vulnerability where preemptive origin credentials are sent in cleartext in the HTTP CONNECT request when using an HTTP proxy to reach an HTTPS origin. This exposes sensitive authentication tokens to the proxy and any observers on the client-to-proxy connection. The issue is fixed in versions 2.16.1 and 3.0.12.

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() paths in libmport/fetch.c accepted non-HTTPS repository and package mirror URLs without a url_is_https() enforcement check. When a cleartext URL was configured or returned by mirror data, a network-positioned attacker could tamper with package index or package download traffic and compromise package selection or integrity. This issue is fixed in version 2.7.8.

AsyncHttpClient versions from 2.1.0 up to but not including 2.16.1 and from 3.0.0 up to but not including 3.0.12 allow proxy credentials to be exposed in cleartext. This occurs when using an authenticated SOCKS proxy, where the Proxy-Authorization header is attached to requests without verifying the proxy type, potentially exposing sensitive credentials to the origin server. The issue is fixed in versions 2.16.1 and 3.0.12.

CVE-2026-73174 is a high-severity vulnerability in the Advantech EKI-1242IEIMS device firmware version V1.06.01. It involves cleartext transmission of sensitive information via the edgserver management protocol, allowing a network-adjacent passive observer to intercept management traffic and recover sensitive device identity and network metadata.

Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors, in versions prior to 4.3.4 of the application and 01.50.001 of the monitor firmware, allows an attacker on the Wi-Fi Direct network to intercept the network password.

An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request.

The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured network traffic contains reconstructable JPEG or WEBP video frames transmitted over UDP. An attacker within local wireless range may capture and reconstruct the live video stream without transport encryption.