Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request.
This issue affects :
* Devolutions Server 2026.2.4.0
* Devolutions Server 2026.1.20.0 and earlier
StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users\<username>\.sdm\state.kv. The file is protected only by default user-level NTFS permissions.
Exploitation requires local read access to the affected user's profile directory and additional deployment and execution conditions on the target host.
The condition was reported through coordinated disclosure by Hope Walker (SpecterOps).
CVE-2026-9274 is a medium severity vulnerability affecting multiple CP Plus Wi-Fi Camera models up to version v02.21.031. It involves cleartext storage of sensitive information in runtime memory, which can be extracted via physical access to the UART interface. Exploiting this flaw allows an attacker to obtain cryptographic private keys, Wi-Fi credentials, and configuration data stored in RAM. This could lead to unauthorized access to encrypted communications and the connected wireless network. No official patch or remediation guidance is currently available from the vendor. The vulnerability requires physical access and has no known exploits in the wild at this time.
Assisted Installer RHEL 9 integrates components for the general multicluster engine
for Kubernetes 2.9.4 release that simplify the process of deploying OpenShift Container
Platform clusters.
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters, or to import existing Kubernetes-based clusters for management.
After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
CVE-2026-8596 is a high-severity vulnerability in the Amazon SageMaker Python SDK affecting versions 2.199.0 through 2.257.1 and 3.0.0 through 3.7.1. It involves cleartext storage of sensitive information in the ModelBuilder/Serve component, allowing a remote authenticated actor with specific permissions to extract the HMAC signing key from API responses. This can enable forging valid integrity signatures for crafted model artifacts, potentially leading to code execution in inference containers. The vulnerability requires the attacker to have permissions to call SageMaker describe APIs and write access to the model artifact S3 path. AWS has released fixed versions 2.257.2 and 3.8.0 to remediate this issue.
CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that could cause the disclosure of a sensitive information which could result in revealing protected source code and loss of confidentiality, When an authorized attacker accesses the source code for editing or compiling it.
When BIG-IP DNS is provisioned, a vulnerability exists in an undisclosed TMOS Shell (tmsh) command that may allow a highly privileged authenticated attacker to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is also logged in the audit log. This may allow a highly privileged, authenticated attacker with access to the audit log to view sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract, upload_wasm, ibc_transfer, etc.) accepted 'mnemonic: string' as an explicit tool-call parameter. The BIP-39 seed was consequently embedded in the LLM tool-call JSON, exposing it to any transport, log, or telemetry surface in the path between the LLM provider and the MCP process. This vulnerability is fixed in 0.x.y-security-1.
CVE-2026-45362 is a vulnerability in Sangoma Switchvox versions before 8.4 where SIP authentication credentials are stored in cleartext within backup files. This cleartext storage of sensitive information could allow an attacker with local access to the backup files to obtain SIP credentials. The vulnerability has a low severity rating with a CVSS score of 3.2. There is no information about an available patch or official remediation at this time.
A vulnerability in electerm versions 3.8.15 and earlier allows exposure of sensitive environment variables to any JavaScript running in the renderer process. This occurs because the getConstants() IPC handler serializes the entire process.env object and exposes it via window.pre.env, accessible through developer tools or compromised webviews. An attacker with JavaScript execution in the renderer can exfiltrate these secrets, potentially leading to cloud account compromise and lateral movement. No patches are available at the time of disclosure.
Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric AnalytiX versions 10.97.3 and prior, Mitsubishi Electric GENESIS versions 11.02 and prior, Mitsubishi Electric MC Works64 all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions Hyper Historian versions 10.97.3 and prior, Mitsubishi Electric Iconics Digital Solutions AnalytiX versions 10.97.3 and prior, and Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.02 and prior allows a local attacker to disclose the SQL Server credentials stored in plaintext within the local SQLite file by exploiting this vulnerability, when the local caching feature using SQLite is enabled and SQL authentication is used for the SQL Server authentication. As a result, the unauthorized attacker could access the SQL Server and disclose, tamper with, or destroy data on the server, potentially cause a denial-of-service (DoS) condition on the system.
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs, local caches, and network proxie. This issue has been patched in version 1.4.10.
Trino is a distributed SQL query engine for big data analytics. From version 439 to before version 480, Iceberg connector REST catalog static credentials (access key) or vended credentials (temporary access key) are accessible to users that have write privilege on SQL level. This issue has been patched in version 480.
CVE-2026-33026 is a critical vulnerability in the 0xJacky nginx-ui web user interface for the Nginx web server. Versions prior to 2.3.4 have a flaw in the backup restore mechanism that allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue involves cleartext storage of sensitive information and improper validation of backup archives. The vulnerability has been patched in version 2.3.4. The CVSS 4.0 score is 9.4, indicating a critical severity level.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database (via SQL injection, a database backup, or misconfigured access controls), they obtain all video passwords in cleartext. Commit f2d68d2adbf73588ea61be2b781d93120a819e36 contains a patch.
CVE-2026-4346 is a vulnerability in TP-Link TL-WR850N v3 routers that involves cleartext storage of administrative and Wi-Fi credentials in flash memory. The device’s serial interface remains enabled and is protected by weak authentication, allowing an attacker with physical access and serial port connectivity to extract sensitive information. Exploiting this vulnerability can lead to full administrative control of the router and unauthorized access to the wireless network. The CVSS score is 5.1, indicating a medium severity level. No patch or official remediation is currently documented.
CVE-2026-33512 is a high-severity improper authentication vulnerability in WWBN AVideo versions up to 26.0. The API plugin exposes a decryptString action without requiring authentication, allowing any user to submit ciphertext and receive the corresponding plaintext. Since ciphertext tokens are publicly accessible via endpoints like view/url2Embed.json.php, attackers can decrypt protected tokens and metadata. This flaw compromises confidentiality but does not affect integrity or availability. A patch has been committed to fix this issue. No known exploits are currently reported in the wild. Organizations using affected versions should update promptly to prevent unauthorized data exposure.