CVE-2026-115400
crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OA
CVSS
4.4
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Oct 22, 2026 · Last modified: Oct 22, 2026 · CWE-312
Not enough EPSS history yet.
crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users' Google Search Console data.
- gist.github.comhttps://gist.github.com/mansurmavlankulov/47cb8e183fec39a7afe599d1082a3399
- github.comhttps://github.com/crawlseo/crawlseo/commit/2ce0b4b2bdd6047e0a9ede037fd355381968d9bc
- github.comhttps://github.com/crawlseo/crawlseo/releases/tag/v0.2.5
- www.vulncheck.comhttps://www.vulncheck.com/advisories/crawlseo-before-cleartext-storage-of-google-oauth-tokens
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-96293——
———A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption feature for macOS allows a local, unprivileged user or process to obtain a managed computer's FileVault Personal Recovery Key by reading a persistently written diagnostic log file left readable by all local users.4hCVE-2026-1142235.5 MED—
———NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after obtaining ADB backup access authorization and user confirmation of the backup, resulting in sensitive information disclosure.3hCVE-2025-72034.9 MED4.1%
——1The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect or obscure these credentials when the remote logging feature is enabled.
An attacker with administrative access to the Management Console or direct access to product files can retrieve these sensitive credentials. This allows for potential manipulation of log entries and compromise of the integrity and confidentiality of the remote log server.2dCVE-2026-1119933.3 LOW1.0%
——0A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Impacted is the function UserDao.login of the file code/src/service/AdminDao.java. This manipulation of the argument Password causes cleartext storage of sensitive information. The attack is restricted to local execution. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.3dCVE-2026-19864—2.1%
——1Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext.
An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.7dCVE-2026-1052714.3 MED0.8%
——0"ゲオアプリ" provided by GEO CORPORATION contains an issue with cleartext storage of sensitive information, which may allow an attacker to obtain the password of a user of the affected application.7d