CWE-319: Cleartext Transmission vulnerabilities

Progress Software WS_FTP Server versions prior to 2025.0.5 have insufficient protection for communications when unencrypted connections are used. This vulnerability could allow a network attacker to intercept sensitive information or modify requests. The issue is addressed in version 2025.0.5.

Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.

Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password.

CVE-2026-70379 affects WolfVision Cynap Pro and Cynap Core Pro devices with the vSolution Matrix feature enabled. These devices may expose current screen content via an unauthenticated, unencrypted RTSP/RTP stream accessible to hosts on the same network segment. This allows unauthorized viewing or capture of presentation content if network access controls are insufficient. The vulnerability is fixed in version 1.78a.

InterSystems IRIS for Health versions 2025.3.0.226, 2026.1.0.235, and 2026.2.0.221 have TLS/SSL encryption disabled by default. This configuration allows transmitted sensitive information to be sent in cleartext, potentially enabling attackers to intercept and use this data to gain unauthorized access to the device.

HCL AppScan Azure Boards Plugin has a vulnerability involving cleartext transmission of sensitive information when communicating with the AppScan server over HTTP. This can allow interception of credentials or authentication tokens. The plugin now warns users against using HTTP and recommends HTTPS for secure communication.

A vulnerability in Gaijin Entertainment's War Thunder game client allows the authentication bearer token to be transmitted in cleartext using only compression, not encryption. This enables a network attacker to intercept and impersonate the user temporarily, accessing game services and some user data. However, full account takeover and sensitive account management functions remain protected.

CVE-2026-15102 is a vulnerability in Autodesk ADP Desktop SDK where sensitive information is transmitted in clear text. This flaw can allow unauthorized parties to intercept and access sensitive data during transmission. The vulnerability affects multiple version ranges of the ADP Desktop SDK. It has a high severity rating with a CVSS score of 7.5. No official patch or remediation details are provided in the available data.

IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to cleartext transmission of sensitive information.

Progress MarkLogic Server versions 11.0.0 up to but not including 11.3.7, and 12.0.0 up to but not including 12.1.0, may transmit sensitive information in cleartext when connecting to Amazon S3 by default. This vulnerability allows a network attacker to intercept data or credentials sent over these connections. The issue is identified as CWE-319 (Cleartext Transmission of Sensitive Information). A fix is available to address this vulnerability.

Progress Software Corporation MarkLogic Server versions 12.0.0 up to but not including 12.1.0 have a vulnerability involving cleartext transmission of sensitive information in certain cluster-management communications. This allows a network-positioned attacker to intercept or modify data transmitted over affected connections. The vulnerability is identified as CWE-319 and has a CVSS 3.1 score of 7.4, indicating high severity.

CVE-2026-107714 is a vulnerability in the sparklemotion mechanize library prior to version 2.14.1. It involves improper handling of HTTP redirects in Mechanize::HTTP::Agent#response_redirect, where redirects are treated as same-origin based only on host matching without consistent scheme and port comparison. This can cause sensitive headers like Authorization and Cookie to be sent over unencrypted HTTP or to unintended ports, potentially exposing credentials. The issue affects caller-supplied headers but does not impact integrity or availability. The vulnerability is fixed in version 2.14.1.

Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE (usage 3) record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record set consisting of DANE-TA (usage 2) or otherwise unusable records as if no records were published, so delivery to such a host fell back to opportunistic TLS. An attacker with an active position on the network path between the server and the recipient's mail exchanger can suppress or break the STARTTLS negotiation and cause messages to be delivered in cleartext, where they can be read and modified.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy authentication and an absolute-form target only from whether the URI is secure. Because ws is not marked secure, the tunneled WebSocket upgrade sent to the origin includes the proxy's Proxy-Authorization value. Basic credentials are directly recoverable and Digest responses can be replayed or cracked offline. This issue is fixed in versions 3.0.12 and 2.16.1.

CVE-2026-107282 is a critical vulnerability in the AsyncHttpClient (AHC) Java library that allows cleartext transmission of sensitive information. Versions prior to 3.0.13 and 2.16.1 have a flaw where cross-host request replay can cause the original host's sensitive data, including path, Host header, and Authorization credentials, to be sent to an unintended replay destination. This occurs due to improper updating of the target request and proxy context during failover and retry scenarios. The issue is fixed in versions 3.0.13 and 2.16.1.

AsyncHttpClient versions prior to 3.0.12 on the 3.x branch and 2.16.1 on the 2.x branch have a vulnerability where sensitive credentials can be transmitted in cleartext over a proxy connection. This occurs because the client incorrectly infers proxy tunnel status, allowing authorization credentials to be sent without encryption after a proxy rejects a CONNECT request. The issue is fixed in versions 3.0.12 and 2.16.1.

AsyncHttpClient versions prior to 3.0.13 and 2.16.1 contain a vulnerability where Digest authentication challenges with missing or empty nonces are incorrectly treated as Basic authentication challenges. This causes the client to resend credentials in cleartext using Basic authentication, exposing sensitive information. The issue affects both origin and proxy challenge parsers and has been fixed in versions 3.0.13 and 2.16.1.

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Because the transport re-dials the hostname rather than the CIDR-matching address, a DNS answer set of one loopback IP plus a non-loopback attacker IP disables certificate verification and enables HTTP fallback for the registry connection.

CVE-2026-105766 is a low-severity vulnerability in Chainguard Academy (edu) caused by the use of the backend-facing $scheme variable in nginx.conf for trailing-slash directory redirects. This results in a 301 redirect from HTTPS to HTTP, exposing documentation content to on-path attackers who can read or modify it. The issue arises because TLS terminates at the load balancer, and the redirect sends clients to an unencrypted HTTP URL. Clients enforcing HSTS, such as browsers with the .dev domain preloaded, are not affected. However, clients that do not enforce HSTS, including some command-line HTTP clients and scripts, remain vulnerable.

Transmission of a sensitive key in the URL over an unencrypted HTTP connection.  The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key