Monthly
Cleartext credential disclosure in OpenProject's Storages module (versions prior to 17.3.3 and 17.4.1) writes the userless OneDrive/SharePoint OAuth access_token in plaintext to Rails.cache under the deterministic key storage.<id>.httpx_access_token, refreshed by an hourly cron and every userless-OAuth call. Because none of the supported cache backends (file_store, memcache, redis) encrypts at rest, an attacker who can read the cache backend retrieves the Azure-AD application-tier bearer token via an anonymous memcached/Redis get. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Sensitive key material extraction is possible in Siemens SIMATIC WinCC Unified PC Runtime versions V16 through V21 (prior to V21 Update 2) due to insufficient protection in the WinCC Certificate Manager component. A local attacker on an affected HMI/SCADA workstation could harvest cryptographic key material that protects operator certificates, potentially enabling impersonation or downstream attacks against industrial control networks. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Fabric OS switch admin passwords can be exposed in Brocade SANnav before 3.0.1 when the host suffers an out-of-memory condition and sensitive credentials are written to a memory swap file. Exploitation requires an authenticated admin with local access to the server hosting the SANnav virtual machine and the ability to read that swap file, making this a local, high-complexity confidentiality issue rather than a remotely reachable compromise; no public exploit identified at time of analysis. Upgrading to 3.0.1 addresses the flaw.
Cleartext storage in PostgreSQL's pgcrypto extension silently exposes PGP-encrypted data as recoverable plaintext when OpenSSL disables the requested cipher, affecting all eight PGP encryption and decryption functions (pgp_sym_encrypt/decrypt, pgp_pub_encrypt/decrypt, and their bytea variants) across PostgreSQL 14 through 18. Beyond confidentiality loss, the same code path defeats the Modification Detection Code (MDC) integrity check, allowing decryption to succeed with an incorrect key - enabling an attacker to inject attacker-controlled plaintext through applications that accept encrypted data as input. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified; fix versions are clearly defined as 18.5, 17.11, 16.15, 15.19, and 14.24.
Cleartext storage of sensitive parameters in Puppet's resource_api module (versions 1.5.0-1.9.1 and 2.0.0) causes passwords and other credential values to persist unmasked in the Puppet agent's local transaction state cache. The sensitive flag - intended to prevent exactly this exposure - is silently dropped during resource_api parameter processing, meaning any resource type built on this API and declaring sensitive parameters leaks those values to the cache filesystem. No public exploit exists and this is not listed in CISA KEV, but the confidentiality impact is high for environments where Puppet manages secrets such as database passwords or API tokens.
Medtronic MyCareLink Patient Monitor stores per-product credentials in a recoverable (non-hashed or weakly encrypted) format, allowing physical attackers with device access to extract these credentials and modify encrypted drive data without authentication. Affected models include the 24950 and 24952 monitors. The vulnerability requires physical access to the device (CVSS AV:P) but grants full confidentiality, integrity, and availability impact to stored patient data.
Cleartext credential storage in PublicCMS 6.202506.a through 6.202506.d exposes user-supplied passwords to any party with read access to the application's log files. The failed login handler (`log_login` in `LoginAdminController.java`) persists the raw `errorPassword` argument to disk without obfuscation, meaning that mistyped or probed passwords accumulate in plaintext logs indefinitely. No public exploit code exists and CISA has not listed this in KEV; EPSS sits at 0.01% (2nd percentile), confirming negligible observed exploitation activity at time of analysis.
Langflow up to version 1.8.3 stores authentication settings in cleartext on disk when processing project creation requests, allowing authenticated remote attackers to read sensitive credentials. The vulnerability exists in the create_project/encrypt_auth_settings function within the Project Creation Endpoint, where the auth_settings parameter bypasses encryption despite the function's intent. Publicly available exploit code exists, and the vendor has not released a patch or responded to disclosure notices.
SourceCodester Student Result Management System 1.0 stores authentication credentials in cleartext within an HTTP-accessible file (/login_credentials.txt), allowing unauthenticated remote attackers to retrieve sensitive login information with low complexity. The vulnerability has publicly available exploit code and carries a CVSS 5.3 score reflecting confidentiality impact without integrity or availability compromise.
MicroServer writes portions of its system firmware, including user and vendor secrets, to an unencrypted external SD card during boot. An attacker with physical access to the SD card can read these plaintext secrets and use them to modify vendor firmware or authenticate to the web portal as an administrator. The EPSS score is 0.01% (1st percentile); no public exploit identified at time of analysis.
Cleartext credential disclosure in OpenProject's Storages module (versions prior to 17.3.3 and 17.4.1) writes the userless OneDrive/SharePoint OAuth access_token in plaintext to Rails.cache under the deterministic key storage.<id>.httpx_access_token, refreshed by an hourly cron and every userless-OAuth call. Because none of the supported cache backends (file_store, memcache, redis) encrypts at rest, an attacker who can read the cache backend retrieves the Azure-AD application-tier bearer token via an anonymous memcached/Redis get. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Sensitive key material extraction is possible in Siemens SIMATIC WinCC Unified PC Runtime versions V16 through V21 (prior to V21 Update 2) due to insufficient protection in the WinCC Certificate Manager component. A local attacker on an affected HMI/SCADA workstation could harvest cryptographic key material that protects operator certificates, potentially enabling impersonation or downstream attacks against industrial control networks. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Fabric OS switch admin passwords can be exposed in Brocade SANnav before 3.0.1 when the host suffers an out-of-memory condition and sensitive credentials are written to a memory swap file. Exploitation requires an authenticated admin with local access to the server hosting the SANnav virtual machine and the ability to read that swap file, making this a local, high-complexity confidentiality issue rather than a remotely reachable compromise; no public exploit identified at time of analysis. Upgrading to 3.0.1 addresses the flaw.
Cleartext storage in PostgreSQL's pgcrypto extension silently exposes PGP-encrypted data as recoverable plaintext when OpenSSL disables the requested cipher, affecting all eight PGP encryption and decryption functions (pgp_sym_encrypt/decrypt, pgp_pub_encrypt/decrypt, and their bytea variants) across PostgreSQL 14 through 18. Beyond confidentiality loss, the same code path defeats the Modification Detection Code (MDC) integrity check, allowing decryption to succeed with an incorrect key - enabling an attacker to inject attacker-controlled plaintext through applications that accept encrypted data as input. No active exploitation is confirmed (not in CISA KEV) and no public exploit has been identified; fix versions are clearly defined as 18.5, 17.11, 16.15, 15.19, and 14.24.
Cleartext storage of sensitive parameters in Puppet's resource_api module (versions 1.5.0-1.9.1 and 2.0.0) causes passwords and other credential values to persist unmasked in the Puppet agent's local transaction state cache. The sensitive flag - intended to prevent exactly this exposure - is silently dropped during resource_api parameter processing, meaning any resource type built on this API and declaring sensitive parameters leaks those values to the cache filesystem. No public exploit exists and this is not listed in CISA KEV, but the confidentiality impact is high for environments where Puppet manages secrets such as database passwords or API tokens.
Medtronic MyCareLink Patient Monitor stores per-product credentials in a recoverable (non-hashed or weakly encrypted) format, allowing physical attackers with device access to extract these credentials and modify encrypted drive data without authentication. Affected models include the 24950 and 24952 monitors. The vulnerability requires physical access to the device (CVSS AV:P) but grants full confidentiality, integrity, and availability impact to stored patient data.
Cleartext credential storage in PublicCMS 6.202506.a through 6.202506.d exposes user-supplied passwords to any party with read access to the application's log files. The failed login handler (`log_login` in `LoginAdminController.java`) persists the raw `errorPassword` argument to disk without obfuscation, meaning that mistyped or probed passwords accumulate in plaintext logs indefinitely. No public exploit code exists and CISA has not listed this in KEV; EPSS sits at 0.01% (2nd percentile), confirming negligible observed exploitation activity at time of analysis.
Langflow up to version 1.8.3 stores authentication settings in cleartext on disk when processing project creation requests, allowing authenticated remote attackers to read sensitive credentials. The vulnerability exists in the create_project/encrypt_auth_settings function within the Project Creation Endpoint, where the auth_settings parameter bypasses encryption despite the function's intent. Publicly available exploit code exists, and the vendor has not released a patch or responded to disclosure notices.
SourceCodester Student Result Management System 1.0 stores authentication credentials in cleartext within an HTTP-accessible file (/login_credentials.txt), allowing unauthenticated remote attackers to retrieve sensitive login information with low complexity. The vulnerability has publicly available exploit code and carries a CVSS 5.3 score reflecting confidentiality impact without integrity or availability compromise.
MicroServer writes portions of its system firmware, including user and vendor secrets, to an unencrypted external SD card during boot. An attacker with physical access to the SD card can read these plaintext secrets and use them to modify vendor firmware or authenticate to the web portal as an administrator. The EPSS score is 0.01% (1st percentile); no public exploit identified at time of analysis.