CVE-2022-2569
The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OA
CVSS
5.5
Medio
EPSS
0.1%
p3
KEV
—
Exploit Today
1
0-100
Publicado: 24 ago 2022 · Última mod.: 9 jul 2026 · CWE-312
0.1%EPSS · 30 días0.1%
2026-08-042026-08-31
The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-737482.2 BAJ—
———A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Fabric Composer.12hCVE-2026-835517.2 ALT—
———Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account.13hCVE-2026-779756.5 MED—
——0The affected Ebyte
product exports administrative credentials and other
sensitive configuration information without adequate protection. An
unauthenticated attacker on the adjacent network who can obtain an
exported configuration file could recover valid credentials and use them
to access the device or similarly configured systems.16hCVE-2026-826992.7 BAJ—
——0A flaw has been found in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This impacts an unknown function of the file aca.sql of the component Password Handler. Executing a manipulation of the argument Password can lead to cleartext storage of sensitive information. The attack can be executed remotely. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable.2dCVE-2026-826405.5 MED0.0%
——0browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.3dCVE-2026-77970—0.8%
——0Cleartext Storage of Sensitive Information vulnerability in ash-project ash_paper_trail allows an attacker with read access to the generated version resource to recover sensitive values nested inside embedded resources, unions, or lists.
sensitive_attributes :redact and :ignore only act on the tracked resource's top-level attributes. maybe_redact_changes/3 and the stored-action-input path in AshPaperTrail.Resource.Changes.CreateNewVersion derive the sensitive set from the resource's own attributes and never descend into embedded, union, or list values, so a non-sensitive attribute or action argument that holds an embed with a sensitive? field (for example an accepted credentials embed carrying a token) is written to the version table in cleartext.
This issue affects ash_paper_trail: from 0.3.0 before 0.7.0.12h