CWE-212
Improper Removal of Sensitive Information Before Storage or Transfer
Monthly
Cleartext third-party credentials are exposed to any authenticated principal holding DDNS read access in Nezha versions 2.2.5 through 2.3.14, because the GET /api/v1/ddns list handler returns DDNS webhook profiles without redacting the WebhookURL and WebhookRequestBody fields. An admin account or a Personal Access Token granted the nezha:ddns:read scope can retrieve tokens embedded directly in other users' webhook URLs (for example query strings such as ?token=...) or request bodies, which the vendor's fix specifically addresses for every user's profiles rather than only the requester's. Per the vendor-assigned CVSS 4.0 vector (7.1, PR:L, VC:H with no integrity or availability impact), the exposure is confidentiality-only and gated behind the authentication and scope prerequisite; no public exploit identified at time of analysis, and neither CISA KEV status nor public exploit code is reported for this issue.
Improper header handling in Canva Mobile App for HarmonyOS before v1.15.1 allows an unauthenticated remote attacker who controls content loaded in a privileged WebView to hijack a logged-in user's session by capturing sensitive headers sent to an external origin. Exploitation requires the victim to interact with the malicious content, and only the HarmonyOS build is affected; iOS and Android are not impacted. No public exploit has been identified at time of analysis, and the assessed risk is conditional rather than a mass-exploitation priority.
Session hijacking in the Canva Android App before version 2.376.0 arises from an unrestricted header-reflection flaw in a privileged WebView component. An attacker who can control an external origin loaded within that WebView receives sensitive HTTP headers - including session tokens - that the app fails to suppress, exposing the authenticated user's session and enabling full account takeover. No public exploit has been identified at time of analysis; the flaw is patched in v2.376.0 per the Canva trust advisory.
nebula-mesh's web mobile-bundle handler leaves the decrypted ed25519 CA private key resident on the Go heap because `mobilebundle.Build` never calls `CAManager.Wipe()` on any of its eleven return paths - success or error - allowing the 64-byte signing key to persist in process memory until garbage collection. An authenticated actor who triggers the `renderMobileBundle` web handler combined with any capability to read process memory (core dump, swap file, or live memory scraping) can recover the CA signing key and mint arbitrary host certificates trusted by every node in the nebula mesh. No public exploit has been identified at time of analysis; the API handler performs correct zeroization via `defer caMgr.Wipe()` and is unaffected.
Authentication bypass in Bludit CMS versions prior to 3.22.0 allows deactivated user accounts to retain authenticated access through persistent 'Remember Me' cookies, because the disable-account workflow fails to invalidate tokenAuth and tokenRemember values stored in the JSON database. Any user who previously logged in with the persistent session option can continue to act with their original privileges even after an administrator disables them. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated configuration readers in OpenClaw gateway deployments can extract unredacted sensitive credentials through alias field bypass in versions prior to 2026.4.14. Attackers with legitimate config read permissions exploit sourceConfig and runtimeConfig alias fields to obtain provider API keys, gateway authentication tokens, and channel credentials that the redaction mechanism fails to sanitize. The vulnerability affects npm package 'openclaw' in gateway configurations where authenticated clients have config read access, confirmed fixed by vendor in version 2026.4.14 with patch commit 86734ef. CVSS 7.1 reflects network-accessible attack requiring low privileges with high confidentiality impact; no public exploit identified at time of analysis, though technical details published in GHSA-8372-7vhw-cm6q enable reproduction.
Authenticated users with low privileges can read cleartext Kubernetes Secret data through Argo CD's ServerSideDiff feature in versions 3.2.0-3.2.10 and 3.3.0-3.3.8. This scope-changing vulnerability (CVSS:3.1 S:C) allows attackers to access sensitive credential data managed by Kubernetes, including database passwords, API tokens, and certificates, by exploiting the server-side diff functionality. With a 7.7 CVSS score and low attack complexity (AC:L), this represents a significant confidentiality breach requiring only network access and basic authentication-no public exploit identified at time of analysis, but the technical barrier to exploitation is minimal.
Information disclosure in MediaWiki CentralAuth extension exposes sensitive authentication data to unauthorized parties through improper removal before storage or transfer. This affects non-release development branches with network-accessible attack vector requiring no authentication (CVSS:4.0 AV:N/PR:N). While no public exploit or active exploitation (not in CISA KEV) is identified at time of analysis, the CVSS 8.8 rating reflects high confidentiality impact and low complexity, making this a significant risk for organizations running development builds.
tfplan2md versions before 1.26.1 fail to properly mask sensitive values in Terraform plan reports across multiple rendering paths, causing credentials and other confidential data to be exposed in plaintext markdown output instead of being redacted. Administrators and developers using affected versions to generate infrastructure reports may inadvertently expose secrets to unauthorized parties with access to the generated documentation. No patch is currently available for this high-severity information disclosure vulnerability affecting Azure and Terraform workflows.
OpenBao's sanitized configuration endpoint (sys/config/state/sanitized) fails to redact the tls_acme_eab_mac_key value, so callers can read the ACME External Account Binding MAC key that operators configured for TLS listener certificate acquisition in versions 2.2.0 through 2.6.3 and 2.7.0. Two preconditions must both hold: the operator must have enabled ACME EAB (a non-default setup, per RFC 8555), and the caller must already hold high privileges (CVSS 3.1 PR:H) sufficient to invoke the administrative endpoint - no user interaction is required. Successful disclosure lets that caller bind their own ACME account to the operator's account at the certificate authority, giving limited confidentiality and integrity impact (C:L/I:L) with no availability effect; no public exploit has been identified at time of analysis and the issue is assessed low priority, consistent with the monitor decision label. Patched releases are OpenBao 2.7.1 and 2.6.4.
Cleartext third-party credentials are exposed to any authenticated principal holding DDNS read access in Nezha versions 2.2.5 through 2.3.14, because the GET /api/v1/ddns list handler returns DDNS webhook profiles without redacting the WebhookURL and WebhookRequestBody fields. An admin account or a Personal Access Token granted the nezha:ddns:read scope can retrieve tokens embedded directly in other users' webhook URLs (for example query strings such as ?token=...) or request bodies, which the vendor's fix specifically addresses for every user's profiles rather than only the requester's. Per the vendor-assigned CVSS 4.0 vector (7.1, PR:L, VC:H with no integrity or availability impact), the exposure is confidentiality-only and gated behind the authentication and scope prerequisite; no public exploit identified at time of analysis, and neither CISA KEV status nor public exploit code is reported for this issue.
Improper header handling in Canva Mobile App for HarmonyOS before v1.15.1 allows an unauthenticated remote attacker who controls content loaded in a privileged WebView to hijack a logged-in user's session by capturing sensitive headers sent to an external origin. Exploitation requires the victim to interact with the malicious content, and only the HarmonyOS build is affected; iOS and Android are not impacted. No public exploit has been identified at time of analysis, and the assessed risk is conditional rather than a mass-exploitation priority.
Session hijacking in the Canva Android App before version 2.376.0 arises from an unrestricted header-reflection flaw in a privileged WebView component. An attacker who can control an external origin loaded within that WebView receives sensitive HTTP headers - including session tokens - that the app fails to suppress, exposing the authenticated user's session and enabling full account takeover. No public exploit has been identified at time of analysis; the flaw is patched in v2.376.0 per the Canva trust advisory.
nebula-mesh's web mobile-bundle handler leaves the decrypted ed25519 CA private key resident on the Go heap because `mobilebundle.Build` never calls `CAManager.Wipe()` on any of its eleven return paths - success or error - allowing the 64-byte signing key to persist in process memory until garbage collection. An authenticated actor who triggers the `renderMobileBundle` web handler combined with any capability to read process memory (core dump, swap file, or live memory scraping) can recover the CA signing key and mint arbitrary host certificates trusted by every node in the nebula mesh. No public exploit has been identified at time of analysis; the API handler performs correct zeroization via `defer caMgr.Wipe()` and is unaffected.
Authentication bypass in Bludit CMS versions prior to 3.22.0 allows deactivated user accounts to retain authenticated access through persistent 'Remember Me' cookies, because the disable-account workflow fails to invalidate tokenAuth and tokenRemember values stored in the JSON database. Any user who previously logged in with the persistent session option can continue to act with their original privileges even after an administrator disables them. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated configuration readers in OpenClaw gateway deployments can extract unredacted sensitive credentials through alias field bypass in versions prior to 2026.4.14. Attackers with legitimate config read permissions exploit sourceConfig and runtimeConfig alias fields to obtain provider API keys, gateway authentication tokens, and channel credentials that the redaction mechanism fails to sanitize. The vulnerability affects npm package 'openclaw' in gateway configurations where authenticated clients have config read access, confirmed fixed by vendor in version 2026.4.14 with patch commit 86734ef. CVSS 7.1 reflects network-accessible attack requiring low privileges with high confidentiality impact; no public exploit identified at time of analysis, though technical details published in GHSA-8372-7vhw-cm6q enable reproduction.
Authenticated users with low privileges can read cleartext Kubernetes Secret data through Argo CD's ServerSideDiff feature in versions 3.2.0-3.2.10 and 3.3.0-3.3.8. This scope-changing vulnerability (CVSS:3.1 S:C) allows attackers to access sensitive credential data managed by Kubernetes, including database passwords, API tokens, and certificates, by exploiting the server-side diff functionality. With a 7.7 CVSS score and low attack complexity (AC:L), this represents a significant confidentiality breach requiring only network access and basic authentication-no public exploit identified at time of analysis, but the technical barrier to exploitation is minimal.
Information disclosure in MediaWiki CentralAuth extension exposes sensitive authentication data to unauthorized parties through improper removal before storage or transfer. This affects non-release development branches with network-accessible attack vector requiring no authentication (CVSS:4.0 AV:N/PR:N). While no public exploit or active exploitation (not in CISA KEV) is identified at time of analysis, the CVSS 8.8 rating reflects high confidentiality impact and low complexity, making this a significant risk for organizations running development builds.
tfplan2md versions before 1.26.1 fail to properly mask sensitive values in Terraform plan reports across multiple rendering paths, causing credentials and other confidential data to be exposed in plaintext markdown output instead of being redacted. Administrators and developers using affected versions to generate infrastructure reports may inadvertently expose secrets to unauthorized parties with access to the generated documentation. No patch is currently available for this high-severity information disclosure vulnerability affecting Azure and Terraform workflows.
OpenBao's sanitized configuration endpoint (sys/config/state/sanitized) fails to redact the tls_acme_eab_mac_key value, so callers can read the ACME External Account Binding MAC key that operators configured for TLS listener certificate acquisition in versions 2.2.0 through 2.6.3 and 2.7.0. Two preconditions must both hold: the operator must have enabled ACME EAB (a non-default setup, per RFC 8555), and the caller must already hold high privileges (CVSS 3.1 PR:H) sufficient to invoke the administrative endpoint - no user interaction is required. Successful disclosure lets that caller bind their own ACME account to the operator's account at the certificate authority, giving limited confidentiality and integrity impact (C:L/I:L) with no availability effect; no public exploit has been identified at time of analysis and the issue is assessed low priority, consistent with the monitor decision label. Patched releases are OpenBao 2.7.1 and 2.6.4.