CVE Database

CVE-2026-73591 High · 7.5 CWE-540 Sep 23, 2026

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains…

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

CVE-2025-36076 Medium · 4.3 CWE-540 Sep 18, 2026

IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by an authenticated user in further attacks against the system.

CVE-2026-84390 Critical · 9.8 CWE-540 Sep 11, 2026

A inclusion of sensitive information in source code vulnerability in Fortinet…

A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7.2.0 through 7.2.2 may allow attacker to improper access control via <insert attack vector here>

CVE-2026-16581 Medium · 5.3 CWE-540 Jul 28, 2026

Inclusion of sensitive information in source code in igloohome Smart Lock Mobile Application

In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source Code vulnerability could allow an unauthorized actor to access functions or backend services that were not sufficiently protected by authentication controls.

CVE-2026-4155 High · 7.5 CWE-540 Apr 10, 2026

ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability

ChargePoint Home Flex Inclusion of Sensitive Information in Source Code Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the genpw script. The issue results from the inclusion of a secret cryptographic seed value within the script. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-26340.

CVE-2026-35383 Medium · 6.5 CWE-540 Apr 2, 2026

Bentley Systems iTwin Platform exposed access token

Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. As of 2026-03-27, the token is no longer present in the web pages and cannot be used to enumerate or delete assets.

CVE-2026-22275 Medium · 4.4 CWE-540 Jan 23, 2026

Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to…

Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains an Inclusion of Sensitive Information in Source Code vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

CVE-2025-36299 Medium · 4.3 CWE-540 Nov 17, 2025

IBM Planning Analytics Information Disclosure

IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system.