Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report

Your agent Now with CVE context

Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.

MoxsoSponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tab
ORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV

Find vulnerabilities that affect you.

Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.

Recent security developments
Severity
Clear filters
28 matching advisories · 28 shown
Explore packages Subscribe to these results
Follow substantive record changes →
SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
medium6.5
CVE-2026-126817

Mongoid stores encrypted fields in plaintext when two models share a collection

A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an application declared for encryption to be written and stored as cleartext when more than one model is mapped onto the same storage location. No error or warning is raised. A party holding an ordinary read-only database account, with no access to the encryption key material, may then obtain those values in clear form.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

MongoDB · Ruby Driver
medium4.3
CVE-2026-116431

Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Cleartext Storage of Sensitive Information vulnerability.

Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Dell · PowerScale InsightIQ
medium6.5
CVE-2026-126643

Aap-gateway-operator: resource-server secret exposed in plaintext in the automationcontroller custom resource

A cleartext storage flaw was found in the AAP Gateway Operator. When reconciling an AutomationController, the operator reads the protected resource-server Secret (Secret/<aap-name>-resource-server, key controller_resource_server_secret) and copies its plaintext value into the generated AutomationController custom resource under spec.extra_settings (RESOURCE_SERVER.SECRET_KEY). Although the operator uses no_log to keep the value out of its own logs, serializing it into the custom resource exposes it to any principal able to read the AutomationController CR without permission to read the backing Kubernetes Secret, breaking the expected OpenShift RBAC separation between the two resources. The value may also propagate into Kubernetes API/etcd storage, GitOps and Argo diffs and history, rendered manifests, support bundles, and audit data. The resource-server secret is intended for trusted Gateway-to-Controller service authentication, and its disclosure may allow a user to impersonate a trusted Controller service and reach privileged service-index APIs.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Red Hat · Red Hat Ansible Automation Platform 2 / Red Hat · Red Hat Ansible Automation Platform 2
unknown
CVE-2026-126328

Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with…

Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Devolutions · Server
high7.1
CVE-2026-115340

Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server

Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Progress Software · WS_FTP Server
medium6.0
CVE-2026-112168

Multiple embedded secrets and weak algorithms in Magistra

The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

GALENO SISTEMI · MAGISTRA
medium6.5
CVE-2026-50204

Apache Airflow: Audit-log secrets masker redacts by key name only, persisting connection and Variable secrets in cleartext

Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the Log.extra column because the secrets masker matched only on configured sensitive key names. An authenticated low-privilege user with read access to the event-log / audit API — with no prior access to the affected connection or variable — could read those rows and recover the credentials verbatim. Users should upgrade to apache-airflow 3.4.0 or later, which masks these values and restricts the affected audit rows to authorized users. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
high7.5
CVE-2026-68933

Chartbrew: Unauthenticated Brute Force of Password-Protected Dashboards Due to Missing Rate Limit and Plaintext Password Storage

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, public dashboard passwords were stored in plaintext, accepted through a URL query parameter, and checked without effective attempt throttling. The vulnerable surface is public password-protected dashboard storage and validation routes. An unauthenticated attacker targets a public password-protected dashboard and repeatedly submits candidate passwords or obtains password-bearing server or proxy logs. Unlimited online guesses enable brute force, while cleartext storage and URL transport expose the secret in application storage and server or proxy access logs. The target must be a public dashboard with password protection enabled. Even failed attempts reveal chart count and configuration without the password; a recovered password grants access to the protected dashboard and its chart data. This vulnerability is fixed in 5.2.3.

No structured fix or guidance is available here. Check the latest publisher advisory.

Public exploit reference

chartbrew · chartbrew
medium5.1
CVE-2026-111495

API keys, credentials, and configuration parameters embedded in the MatchPoint APK

API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

TPC Software · Matchpoint
high8.8
CVE-2026-54145

OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)

OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses, including during normal desktop operation. An attacker who obtains these artifacts can recover the token and access the core RPC interface while it remains valid. This can expose sensitive agent and integration data and permit privileged operations. Stable tokens remain usable until rotated; launch-specific tokens remain usable while the corresponding core instance is active. The fix is included in version 0.57.5.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

tinyhumansai · openhuman
high7.5
CVE-2026-123059

Keycloak admin client secret stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts

In Eclipse BaSyx Helm Charts version 2.2.0 of the aas-basyx-v2-full chart, deployments with the bundled Keycloak enabled store the client secret of the basyx-technical-user OAuth2 client in cleartext in a Kubernetes ConfigMap. This client uses the client-credentials grant and its service account holds the realm admin role.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Eclipse Foundation · Eclipse BaSyx Helm Charts
high7.5
CVE-2026-123047

Keycloak admin user password stored in cleartext in a ConfigMap in Eclipse BaSyx Helm Charts

In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the basyx chart, deployments with the bundled Keycloak enabled store the passwords of the Keycloak users that the chart creates in cleartext in a Kubernetes ConfigMap.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Eclipse Foundation · Eclipse BaSyx Helm Charts
medium5.9
CVE-2026-114551

MailEnable Auth Cleartext Storage Information Disclosure Vulnerability

MailEnable Auth Cleartext Storage Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MailEnable. Authentication is not required to exploit this vulnerability.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

MailEnable · MailEnable
high7.5
CVE-2026-120733

Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the…

Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Devolutions · Server
high8.6
CVE-2026-114217

Konflux-ci: github token plaintext exposure in ci/cd scripts

A flaw was found in konflux-ci. Continuous Integration (CI) automation scripts store sensitive GitHub access tokens in plaintext on the runner without cleaning them up after execution. A local attacker with access to the CI environment can read these stored credentials to gain unauthorized repository access, potentially allowing them to modify source code or release artifacts.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

konflux-ci
medium6.5
CVE-2026-110200

Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

IBM · Langflow OSS
medium6.9
CVE-2026-77054

Cleartext Storage of Sensitive Information in boneIO

boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated user can call the endpoint and access the administrative passwords in cleartext form. Critically, due to CVE-2026-77053 (authentication disabled by default), an unauthenticated attacker on the same local network can retrieve all passwords.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

boneIO · boneIO
medium6.7
CVE-2026-115400

crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens

crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read access to obtain Google OAuth access and refresh tokens stored unencrypted in the User.googleTokens column. Attackers can read the plaintext long-lived refresh tokens from a compromised or exposed Postgres database to gain indefinite, unauthenticated access to all registered users' Google Search Console data.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

crawlseo · crawlseo
medium6.7
CVE-2026-114223

NewType Infortech｜NT OneAPP - Exposure of Sensitive Information

NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after obtaining ADB backup access authorization and user confirmation of the backup, resulting in sensitive information disclosure.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

NewType Infortech · NT OneAPP
low3.3
CVE-2026-77564

Talos Linux: Support bundle does not redact registry credentials

Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore disclose private registry authentication parameters, with impact depending on the registry's network exposure and credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

siderolabs · talos
medium6.5
CVE-2026-59244

Apache Airflow: Secrets masker: `var.json` Variable values not masked in the Rendered Templates UI

Apache Airflow's secrets masker did not mask var.json Variable values whose value is a dict in the Rendered Templates UI — the dict value failed an isinstance(str) guard — so a secret stored as a JSON Variable and referenced in a template via var.json was displayed in cleartext to any user with access to that task's Rendered Templates view. Users are advised to upgrade to apache-airflow 3.3.1 or later, which masks nested Variable values regardless of type.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
medium6.5
CVE-2026-68970

Apache Airflow: Values of a list-shaped Variable are not masked in task logs and the Rendered Templates UI

Apache Airflow's Task SDK did not mask the contents of a Variable whose JSON value is a list, so secrets stored in that shape appeared in cleartext in task logs and in the Rendered Templates UI. Masking was applied only when the deserialized value was a string or a dict; a list at the top level matched neither and was returned unmasked. Any authenticated user able to read the logs or rendered templates of a task that references such a Variable could recover the values, with no special configuration required. This is the list-shaped counterpart of CVE-2026-59244, whose fix covered the dict case only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Apache Software Foundation · Apache Airflow / Apache Software Foundation · Apache Airflow
medium5.5
CVE-2026-61928

Windows Hello Tampering Vulnerability

Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

Microsoft · Windows 10 Version 1607 / Microsoft · Windows 10 Version 1809
medium6.5
CVE-2026-19391

Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded archives

A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

Red Hat · Pen Drive Powered by Red Hat Lightspeed / Red Hat · Pen Drive Powered by Red Hat Lightspeed
medium5.1
CVE-2026-65599

n8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure via JWT Header

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field (intended only for a key identifier). Because JWT headers are Base64-encoded rather than encrypted, the private key could be recovered by anything that logged or inspected the JWT. An attacker who obtained the key could impersonate the service account and access or modify any Google Cloud resource it was authorized to use. Only instances using Google Service Account credentials are affected.

No structured fix or guidance is available here. Check the latest publisher advisory.

Exploitation not established

n8n-io · n8n / n8n-io · n8n
medium4.9
CVE-2024-7259

Ovirt-engine: potential exposure of cleartext provider passwords via web ui

A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext.

Review the recorded instructions. Guidance may be a workaround rather than a fixed version.

Exploitation not established

ovirt-engine / Red Hat · Red Hat Virtualization 4