CVE-2026-59657 is a high-severity vulnerability in Apache CloudStack that involves cleartext storage of sensitive information in the AsyncJob database storage. This affects versions from 4.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. The vulnerability allows sensitive data to be stored without encryption, potentially exposing it to unauthorized access. The issue is fixed in versions 4.20.3.1 and 4.22.1.1 or later.
CVE-2026-15065 is a critical vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 NIM where intermediate certificate authority private keys are exposed in a publicly available update file. This cleartext storage of sensitive information could allow a remote attacker to bypass security restrictions.
CVE-2026-5224 is a medium severity vulnerability in Cryptosim by Kriptok Crypto and Information Technologies Industry Trade Inc. It involves cleartext storage of sensitive information, allowing retrieval of embedded sensitive data. This affects versions before 3.1.0.229.
Apache Airflow's secrets masker did not mask `var.json` Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an `isinstance(str)` guard — so a secret stored as a JSON Variable and referenced in a template via `var.json` was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.
Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special configuration required. This is the list-shaped counterpart of CVE-2026-59244, whose fix covered the dict case only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
TypeBot is a chatbot builder tool. In version 3.16.1, API tokens (bearer credentials used to authenticate against the builder API) are stored in the database as cleartext strings. An attacker who gains read access to the database (e.g., via SQL injection, backup exposure, or insider access) can extract all API tokens and impersonate any user without requiring a password or multi-factor authentication. Version 3.17.0 fixes the issue.
CVE-2026-21080 is a medium severity vulnerability in Samsung Mobile Smart Switch where sensitive information is stored in cleartext in versions prior to 3.7.72.6. This flaw allows adjacent attackers to access sensitive data due to improper storage practices. No official patch or remediation guidance has been provided yet.
CVE-2026-15721 is a critical vulnerability in Bilin Software and Informatics Consultancy Inc.'s HUMANIST Digital Human Resources product, version 26.0. It involves cleartext storage of sensitive information, classified under CWE-312, which also allows for SQL Injection. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No official patch or remediation guidance has been provided yet.
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data.
This issue affects XAAP Application: before 1.53.
Spring Tools for Eclipse versions 5.2.0 and earlier store the Spring Boot DevTools remote secret in cleartext within launch configuration files. These files are saved as XML in the workspace metadata or project directories, potentially exposing the secret if accessed via filesystem, backups, or version control. The secret protects the remote restart/reload endpoint, which can execute arbitrary class bytes on the target application. Exposure of this secret could allow an attacker with read access to achieve remote code execution. The vulnerability has a medium severity with a CVSS score of 4.4.
The web management interface in Tycon Systems TPDIN-Monitor-WEB2
stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used to compromise other systems on the local network.
Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected.
VSee Clinic version 7.1.26 and VSee Clinic API 1.3.0 expose cleartext SFTP credentials in HTTP responses from three unauthenticated endpoints when SFTP is configured. This allows unauthenticated remote attackers to obtain sensitive credentials without authentication, potentially leading to unauthorized access to the SFTP server. The vulnerability is identified as CWE-201 (Insertion of Sensitive Information into Sent Data) and CWE-312 (Cleartext Storage of Sensitive Information).
Grav is a file-based Web platform. Prior to 1.7.53, an authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration, through the backup download endpoint protected only by the session-static admin-nonce URL parameter. This issue is reported as fixed in version 1.7.53.
Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.
Steeltoe.Configuration.Abstractions versions 4.0.0 through 4.1.0 improperly store TLS client credentials from MySQL or PostgreSQL service bindings in world-readable temporary files on Linux systems. These files are created with permissions that allow other users to read sensitive key material and are not deleted after use. Version 4.2.0 addresses this issue by patching the insecure file handling. The vulnerability has a medium severity rating with a CVSS score of 4.7.