Skip to content
Noroxi

CWE-526 · 22 records

Cleartext Storage of Sensitive Information in an Environment Variable

CVEs in this class

22 records

  • CVE-2023-5720
    30Monitor

    Quarkus: build env information disclosure via gradle plugin

    HighCVSS 7.5No exploitEPSS 1%

    quarkus · quarkusNov 15, 2023

  • CVE-2025-28381
    30Monitor

    A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all conta

    HighCVSS 7.5No exploitEPSS 1%

    openc3 · cosmosJun 13, 2025

  • CVE-2026-45370
    30Monitor

    python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection

    HighCVSS 7.7No exploitEPSS 0%

    universal-tool-calling-protocol · python-utcpMay 14, 2026

  • CVE-2024-2700
    28Monitor

    Quarkus-core: leak of local configuration properties into quarkus applications

    HighCVSS 7.0No exploitEPSS 0%

    red hat · hawtio 4.0.0 for red hat build of apache camel 4Apr 4, 2024

  • CVE-2024-4369
    27Monitor

    Cluster-image-registry-operator: exposes a secret via env variable in pod definition on azure

    MediumCVSS 6.8No exploitEPSS 1%

    red hat · red hat openshift container platform 4.14Apr 30, 2024

  • CVE-2023-43029
    27Monitor

    IBM Storage Virtualize vSphere Remote Plug-in information disclosure

    MediumCVSS 6.8No exploitEPSS 0%

    ibm · storage virtualize plugin for vsphereMar 21, 2025

  • CVE-2026-76227
    27Monitor

    Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure

    MediumCVSS 6.8No exploitEPSS 0%

    renovatebot · renovateAug 19, 2026

  • CVE-2026-72648
    26Monitor

    Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure

    MediumCVSS 6.5No exploitEPSS 0%

    elastic · elastic cloud on kubernetesAug 13, 2026

  • CVE-2026-40153
    26Monitor

    PraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool

    MediumCVSS 6.5No exploitEPSS 0%

    praison · praisonaiagentsApr 9, 2026

  • CVE-2025-36017
    26Monitor

    IBM Controller Information Disclosure

    MediumCVSS 6.5No exploitEPSS 0%

    ibm · controllerDec 8, 2025

  • CVE-2024-12604
    26Monitor

    Improper Authentication in Tapandsign Technologies Tap and Sign App

    MediumCVSS 6.5No exploitEPSS 0%

    tapandsign · tap\&signMar 10, 2025

  • CVE-2026-108592
    24Monitor

    mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment

    MediumCVSS 6.0Proof of conceptEPSS 0%

    swe-agent · mini-swe-agent4 days ago

  • CVE-2025-0985
    22Monitor

    IBM MQ information disclosure

    MediumCVSS 5.5No exploitEPSS 0%

    ibm · mqFeb 28, 2025

  • CVE-2023-47615
    22Monitor

    A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion E

    MediumCVSS 5.5No exploitEPSS 0%

    telit · bgs5 firmwareNov 9, 2023

  • CVE-2014-2377
    21Monitor

    Ecava IntegraXor SCADA Server Information Exposure Through Environmental Variables

    MediumCVSS 5.0No exploitEPSS 2%

    ecava · integraxorSep 15, 2014

  • CVE-2025-27899
    21Monitor

    Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows

    MediumCVSS 5.3No exploitEPSS 0%

    ibm · db2 recovery expertFeb 17, 2026

  • CVE-2024-11736
    19Monitor

    Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables

    MediumCVSS 4.9No exploitEPSS 1%

    red hat · red hat build of keycloak 26.0Jan 14, 2025

  • CVE-2025-9162
    19Monitor

    Org.keycloak/keycloak-model-storage-service: variable injection into environment variables

    MediumCVSS 4.9No exploitEPSS 0%

    keycloak · keycloakAug 21, 2025

  • GHSA-w2wj-hw98-233h
    19Monitor

    Duplicate Advisory: Keycloak Potential Variable Reference in Model Storage Services

    MediumCVSS 4.9No exploit

    Maven · org.keycloak:keycloak-model-storage-servicesAug 21, 2025

  • CVE-2026-49377
    17Monitor

    In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters

    MediumCVSS 4.3No exploitEPSS 1%

    jetbrains · teamcityMay 29, 2026

  • CVE-2023-35931
    17Monitor

    Shescape potential environment variable exposure on Windows with CMD

    MediumCVSS 4.3No exploitEPSS 1%

    shescape project · shescapeJun 23, 2023

  • CVE-2025-36105
    17Monitor

    IBM Planning Analytics Advanced Certified Containers is vulnerable to a sensitive information disclosure vulnerability

    MediumCVSS 4.4No exploitEPSS 0%

    ibm · planning analytics advanced certified containersMar 10, 2026

All vulnerability classes