CWE-212
Improper Removal of Sensitive Information Before Storage or Transfer
Monthly
Information disclosure in IBM UrbanCode Deploy and IBM DevOps Deploy exposes sensitive deployment secrets in plaintext to authenticated users who should only see redacted values. The root cause is a character-parsing failure in the redaction engine: when a secure property value begins with certain non-ASCII characters, the masking logic fails to suppress subsequent ASCII secure values embedded within non-secure properties, rendering them visible through the UI and REST API. No active exploitation or public POC has been identified; the CVSS score of 6.5 reflects high confidentiality impact (C:H) gated behind low-privilege authentication (PR:L).
Session hijacking in the Canva Android App before version 2.376.0 arises from an unrestricted header-reflection flaw in a privileged WebView component. An attacker who can control an external origin loaded within that WebView receives sensitive HTTP headers - including session tokens - that the app fails to suppress, exposing the authenticated user's session and enabling full account takeover. No public exploit has been identified at time of analysis; the flaw is patched in v2.376.0 per the Canva trust advisory.
Information disclosure in Microsoft .NET (versions 8.0.0-8.0.29, 9.0.0-9.0.18, and 10.0.0-10.0.10) and Visual Studio 2022/2026 exposes sensitive data over the network due to improper sanitization of information prior to network transfer, classified under CWE-212. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates unauthenticated network exploitation gated by high attack complexity, yielding full confidentiality compromise (C:H) with no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC confirms no known exploitation, and Microsoft has released patches across all affected product lines.
Sensitive memory exposure in kronosnet (versions <=1.34) allows a local attacker to recover live cluster encryption keys from freed heap memory following cryptographic configuration changes. Affected deployments include Red Hat Enterprise Linux 8, 9, 10, and OpenShift Container Platform 4, where kronosnet underpins the high-availability networking stack. Successful key recovery enables full decryption of cluster communications or malicious packet injection capable of destabilizing HA cluster quorum - no public exploit code identified and no CISA KEV listing at time of analysis.
nebula-mesh's web mobile-bundle handler leaves the decrypted ed25519 CA private key resident on the Go heap because `mobilebundle.Build` never calls `CAManager.Wipe()` on any of its eleven return paths - success or error - allowing the 64-byte signing key to persist in process memory until garbage collection. An authenticated actor who triggers the `renderMobileBundle` web handler combined with any capability to read process memory (core dump, swap file, or live memory scraping) can recover the CA signing key and mint arbitrary host certificates trusted by every node in the nebula mesh. No public exploit has been identified at time of analysis; the API handler performs correct zeroization via `defer caMgr.Wipe()` and is unaffected.
Unredacted iSCSI credential disclosure in OpenStack Ironic through 35.0.1 occurs specifically when an authenticated operator issues a PATCH request to update authorized fields in a node's volume properties - the API response returns sensitive data such as iSCSI CHAP usernames and secrets in plaintext. The scope change reflected in the CVSS (S:C) is meaningful: leaked storage credentials extend the blast radius beyond Ironic itself to the underlying iSCSI storage infrastructure. Notably, the same volume properties endpoint does not exhibit this behavior on POST requests, isolating the flaw to the PATCH response serialization path. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Authentication bypass in Bludit CMS versions prior to 3.22.0 allows deactivated user accounts to retain authenticated access through persistent 'Remember Me' cookies, because the disable-account workflow fails to invalidate tokenAuth and tokenRemember values stored in the JSON database. Any user who previously logged in with the persistent session option can continue to act with their original privileges even after an administrator disables them. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Factory reset in GNCC GP5 firmware v7.1.76 fails to purge cryptographic material from the JFFS2 configuration partition, leaving sensitive user data recoverable after a reset operation. An attacker with physical access to a reset device - such as a discarded, resold, or stolen unit - can read the raw flash storage and extract retained secrets. No public exploit identified at time of analysis as KEV-confirmed active exploitation, though a publicly available proof-of-concept exists per SSVC data and researcher publication.
Sensitive file content written by coding agents is inadvertently persisted to a local SQLite database in Gryph versions up to and including 0.6.0 due to a payload redaction failure in the logging subsystem. The ContentPreview, OldString, and NewString fields of file-write tool payloads bypass the product's own sensitive file filter at both the default 'standard' and 'full' log levels - a behavior compounded by incorrect README documentation claiming the default level was 'minimal'. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.01% (2nd percentile), reflecting the local-access prerequisite and niche deployment footprint. A vendor patch is available in v0.7.0.
A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity.
Information disclosure in IBM UrbanCode Deploy and IBM DevOps Deploy exposes sensitive deployment secrets in plaintext to authenticated users who should only see redacted values. The root cause is a character-parsing failure in the redaction engine: when a secure property value begins with certain non-ASCII characters, the masking logic fails to suppress subsequent ASCII secure values embedded within non-secure properties, rendering them visible through the UI and REST API. No active exploitation or public POC has been identified; the CVSS score of 6.5 reflects high confidentiality impact (C:H) gated behind low-privilege authentication (PR:L).
Session hijacking in the Canva Android App before version 2.376.0 arises from an unrestricted header-reflection flaw in a privileged WebView component. An attacker who can control an external origin loaded within that WebView receives sensitive HTTP headers - including session tokens - that the app fails to suppress, exposing the authenticated user's session and enabling full account takeover. No public exploit has been identified at time of analysis; the flaw is patched in v2.376.0 per the Canva trust advisory.
Information disclosure in Microsoft .NET (versions 8.0.0-8.0.29, 9.0.0-9.0.18, and 10.0.0-10.0.10) and Visual Studio 2022/2026 exposes sensitive data over the network due to improper sanitization of information prior to network transfer, classified under CWE-212. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates unauthenticated network exploitation gated by high attack complexity, yielding full confidentiality compromise (C:H) with no integrity or availability impact. No public exploit code has been identified at time of analysis, CISA SSVC confirms no known exploitation, and Microsoft has released patches across all affected product lines.
Sensitive memory exposure in kronosnet (versions <=1.34) allows a local attacker to recover live cluster encryption keys from freed heap memory following cryptographic configuration changes. Affected deployments include Red Hat Enterprise Linux 8, 9, 10, and OpenShift Container Platform 4, where kronosnet underpins the high-availability networking stack. Successful key recovery enables full decryption of cluster communications or malicious packet injection capable of destabilizing HA cluster quorum - no public exploit code identified and no CISA KEV listing at time of analysis.
nebula-mesh's web mobile-bundle handler leaves the decrypted ed25519 CA private key resident on the Go heap because `mobilebundle.Build` never calls `CAManager.Wipe()` on any of its eleven return paths - success or error - allowing the 64-byte signing key to persist in process memory until garbage collection. An authenticated actor who triggers the `renderMobileBundle` web handler combined with any capability to read process memory (core dump, swap file, or live memory scraping) can recover the CA signing key and mint arbitrary host certificates trusted by every node in the nebula mesh. No public exploit has been identified at time of analysis; the API handler performs correct zeroization via `defer caMgr.Wipe()` and is unaffected.
Unredacted iSCSI credential disclosure in OpenStack Ironic through 35.0.1 occurs specifically when an authenticated operator issues a PATCH request to update authorized fields in a node's volume properties - the API response returns sensitive data such as iSCSI CHAP usernames and secrets in plaintext. The scope change reflected in the CVSS (S:C) is meaningful: leaked storage credentials extend the blast radius beyond Ironic itself to the underlying iSCSI storage infrastructure. Notably, the same volume properties endpoint does not exhibit this behavior on POST requests, isolating the flaw to the PATCH response serialization path. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Authentication bypass in Bludit CMS versions prior to 3.22.0 allows deactivated user accounts to retain authenticated access through persistent 'Remember Me' cookies, because the disable-account workflow fails to invalidate tokenAuth and tokenRemember values stored in the JSON database. Any user who previously logged in with the persistent session option can continue to act with their original privileges even after an administrator disables them. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Factory reset in GNCC GP5 firmware v7.1.76 fails to purge cryptographic material from the JFFS2 configuration partition, leaving sensitive user data recoverable after a reset operation. An attacker with physical access to a reset device - such as a discarded, resold, or stolen unit - can read the raw flash storage and extract retained secrets. No public exploit identified at time of analysis as KEV-confirmed active exploitation, though a publicly available proof-of-concept exists per SSVC data and researcher publication.
Sensitive file content written by coding agents is inadvertently persisted to a local SQLite database in Gryph versions up to and including 0.6.0 due to a payload redaction failure in the logging subsystem. The ContentPreview, OldString, and NewString fields of file-write tool payloads bypass the product's own sensitive file filter at both the default 'standard' and 'full' log levels - a behavior compounded by incorrect README documentation claiming the default level was 'minimal'. No active exploitation is confirmed (not in CISA KEV), and EPSS is 0.01% (2nd percentile), reflecting the local-access prerequisite and niche deployment footprint. A vendor patch is available in v0.7.0.
A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity.