Base de CVEs

CVE-2026-82153 Baixa · 2.2 CWE-922 14/10/2026

Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive...

Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.

CVE-2026-89075 Alta · 7.3 CWE-922 14/10/2026

MOVEit Transfer Local Disclosure of Session Information Vulnerability

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-5047 Média · 5.7 CWE-922 08/10/2026

Insecure Storage of Sensitive Information em Brocade SANnav

A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords.

CVE-2026-5515 Média · 5.5 CWE-922 27/05/2026

IBM App Connect Enterprise is vulnerable to a confidential disclosure

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores potentially sensitive information in log files that could be read by a local user.

CVE-2025-32751 Média · 5.5 CWE-922 22/05/2026

Insecure Storage of Sensitive Information em Dell Powerflex Appliance Intelligent Catalog

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information.

CVE-2025-32746 Média · 5.5 CWE-922 22/05/2026

Insecure Storage of Sensitive Information em Dell Powerflex Appliance Intelligent Catalog

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to unauthorized access to sensitive information.

CVE-2026-7257 Média · 4.4 CWE-922 12/05/2026

Insecure Storage of Sensitive Information em Zyxel Wre6505 Firmware

** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow a local attacker with administrator privileges to download and decrypt a backup configuration file.

CVE-2026-40868 Alta · 8.1 CWE-922 21/04/2026

kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 1.16.4, kyverno’s apiCall servicecall helper implicitly injects Authorization: Bearer ... using the kyverno controller serviceaccount token when a policy does not explicitly set an Authorization header. Because context.apiCall.service.url is policy-controlled, this can send the kyverno serviceaccount token to an attacker-controlled endpoint (confused deputy). Namespaced policies are blocked from servicecall usage by the namespaced urlPath gate in pkg/engine/apicall/apiCall.go, so this report is scoped to ClusterPolicy and global context usage. This vulnerability is fixed in 1.16.4.

CVE-2026-26152 Alta · 7.0 CWE-922 14/04/2026

Microsoft Cryptographic Services Elevation of Privilege Vulnerability

Insecure storage of sensitive information in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.

CVE-2025-10734 Média · 5.3 CWE-922 23/03/2026

ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Sensitive Information Exposure

The ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.12 via the syncedData function. This makes it possible for unauthenticated attackers to extract sensitive data including user names, emails, phone numbers, addresses.

CVE-2026-20629 Média · 5.5 CWE-922 11/02/2026

Insecure Storage of Sensitive Information em Apple Macos

A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Tahoe 26.3. An app may be able to access user-sensitive data.

CVE-2025-14376 Alta · 8.6 CWE-922 20/01/2026

Verve Asset Manager – Plaintext Storage Vulnerabilities

A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext secrets stored in environment variables on the ADI server. This component has been retired and has been optional since the 1.36 release in 2024.

CVE-2025-10971 Alta · 8.8 CWE-922 02/12/2025

Insecure Storage of Sensitive Information

Insecure Storage of Sensitive Information vulnerability in MeetMe on iOS, Android allows Retrieve Embedded Sensitive Data. This issue affects MeetMe: through v2.2.5.

CVE-2025-12539 Crítica · 10.0 CWE-922 11/11/2025

TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover

The TNC Toolbox: Web Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2. This is due to the plugin storing cPanel API credentials (hostname, username, and API key) in files within the web-accessible wp-content directory without adequate protection in the "Tnc_Wp_Toolbox_Settings::save_settings" function. This makes it possible for unauthenticated attackers to retrieve these credentials and use them to interact with the cPanel API, which can lead to arbitrary file uploads, remote code execution, and full compromise of the hosting environment.

CVE-2025-21045 Média · 5.5 CWE-922 10/10/2025

Insecure Storage of Sensitive Information em Samsung Wear Os

Insecure storage of sensitive information in Galaxy Watch prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information.