# CWE-214.

Every Advisory and CVE whose sources give the weakness CWE-214, newest first.

## Records, newest first

- [nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line](https://agentprime.io/advisories/CVE-2026-121745.md)
  `CVE-2026-121745` · CVE record: nvm-sh nvm · CVSS 2.0 Low · Not analysed yet · Published 4 Nov 2026 · Tags: CWE-214
- [pgAdmin 4: Server passwords are left in pgAdmin's process environment](https://agentprime.io/advisories/CVE-2026-116246.md)
  `CVE-2026-116246` · CVE record: pgadmin.org pgAdmin 4 · CVSS 7.0 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-214, CWE-526
- [Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java](https://agentprime.io/advisories/CVE-2026-119117.md)
  `CVE-2026-119117` · CVE record: AWS amazon-kinesis-producer · CVSS 8.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure, CWE-214
- [Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store](https://agentprime.io/advisories/CVE-2026-92171.md)
  `CVE-2026-92171` · CVE record: Red Hat Red Hat Data Grid 8 · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: CWE-214
- [Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line arguments](https://agentprime.io/advisories/CVE-2026-113496.md)
  `CVE-2026-113496` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 2 more · CVSS 5.0 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-214
- [Cockpit-machines: cockpit-appstream: rhsm access-token disclosure through image helper command-line arguments](https://agentprime.io/advisories/CVE-2026-113495.md)
  `CVE-2026-113495` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 2 more · CVSS 5.0 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: CWE-214
- [Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool](https://agentprime.io/advisories/CVE-2026-109971.md)
  `CVE-2026-109971` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 4.7 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: CWE-214
- [wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments](https://agentprime.io/advisories/CVE-2026-102371.md)
  `CVE-2026-102371` · CVE record: Canonical Ubuntu Pro for WSL · CVSS 5.7 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: CWE-214
- [microsandbox: Secret values exposed in world-readable process arguments](https://agentprime.io/advisories/GHSA-m8f5-rh7h-vgg3.md)
  `GHSA-m8f5-rh7h-vgg3`, `CVE-2026-61670` · crates.io `microsandbox`: affected `<0.5.10`, fixed in `0.5.10` · CVSS 6.5 Medium · Not analysed yet · Published 22 Sept 2026 · Tags: CWE-214
- [Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments](https://agentprime.io/advisories/CVE-2026-92768.md)
  `CVE-2026-92768` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-214
- [Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list](https://agentprime.io/advisories/CVE-2026-92747.md)
  `CVE-2026-92747` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 1 more · CVSS 5.0 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-214
- [Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments](https://agentprime.io/advisories/CVE-2026-92745.md)
  `CVE-2026-92745` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 1 more · CVSS 5.0 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: CWE-214
- [In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument ...](https://agentprime.io/advisories/GHSA-rx2c-m92f-qv6p.md)
  `GHSA-rx2c-m92f-qv6p`, `CVE-2026-81684`, `PYSEC-2026-3958` · PyPI `openssl-encrypt`: affected `<1.4.9`, fixed in `1.4.9` · CVSS 6.9 Medium · Not analysed yet · Published 27 Aug 2026 · Tags: CWE-214
- [Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listings](https://agentprime.io/advisories/CVE-2026-80158.md)
  `CVE-2026-80158` · CVE record: Red Hat Red Hat Ceph Storage 5 and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Aug 2026 · Tags: CWE-214
- [NVIDIA NemoClaw: NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of…](https://agentprime.io/advisories/CVE-2026-65088.md)
  `CVE-2026-65088` · CVE record: NVIDIA NemoClaw · CVSS 5.5 Medium · Not analysed yet · Published 25 Aug 2026 · Tags: CWE-214
- [Black Duck blackduck-c-cpp: Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp…](https://agentprime.io/advisories/CVE-2026-76054.md)
  `CVE-2026-76054` · CVE record: Black Duck blackduck-c-cpp · CVSS 7.1 High · Not analysed yet · Published 24 Aug 2026 · Tags: CWE-214
- [Exposure of OTP Secret Through Process Command-Line Arguments in TÜBİTAK BİLGEM's eta-otp-lock](https://agentprime.io/advisories/CVE-2026-18915.md)
  `CVE-2026-18915` · CVE record: TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock · CVSS 5.0 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: CWE-214
- [GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)](https://agentprime.io/advisories/GHSA-94p4-4cq8-9g67.md)
  `GHSA-94p4-4cq8-9g67`, `CVE-2026-73622`, `PYSEC-2026-3951` · PyPI `gitpython`: affected `<3.1.55`, fixed in `3.1.55` · CVSS 8.7 High · Not analysed yet · Published 24 Jul 2026 · Tags: Information disclosure, CWE-214
- [Tanium addressed an information disclosure vulnerability in Connect.](https://agentprime.io/advisories/CVE-2026-12139.md)
  `CVE-2026-12139` · CVE record: Tanium Connect · CVSS 4.4 Medium · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-214
- [ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line](https://agentprime.io/advisories/CVE-2026-9494.md)
  `CVE-2026-9494` · CVE record: Canonical ubuntu-pro-client (ubuntu-advantage-tools) and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-214
- [Sensitive Data Exposure in TUBITAK BILGEM's Pardus Domain Joiner](https://agentprime.io/advisories/CVE-2026-12250.md)
  `CVE-2026-12250` · CVE record: TUBITAK BILGEM Software Technologies Research Institute Pardus Domain Joiner · CVSS 7.9 High · Not analysed yet · Published 5 Jul 2026 · Tags: CWE-214
- [PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution](https://agentprime.io/advisories/GHSA-pj2r-f9mw-vrcq.md)
  `GHSA-pj2r-f9mw-vrcq`, `CVE-2026-40159`, `PYSEC-2026-2918` · PyPI `praisonai`: affected `<4.5.128`, fixed in `4.5.128` · CVSS 5.5 Medium · Not analysed yet · Published 10 Apr 2026 · Tags: Information disclosure, CWE-214
- [OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes](https://agentprime.io/advisories/GHSA-j9pv-rrcj-6pfx.md)
  `GHSA-j9pv-rrcj-6pfx`, `CVE-2026-41357` · npm `openclaw`: affected `<2026.3.31`, fixed in `2026.3.31` · CVSS 2.0 Low · Not analysed yet · Published 2 Apr 2026 · Tags: CWE-212, CWE-214
- [openssl-encrypt has visible password in process list via --password CLI argument](https://agentprime.io/advisories/GHSA-h3m5-p59h-x88p.md)
  `GHSA-h3m5-p59h-x88p`, `CVE-2026-74873`, `PYSEC-2026-3753` · PyPI `openssl-encrypt`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 8.7 High · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-214, CWE-256
- [NATS credentials are exposed in monitoring port via command-line argv](https://agentprime.io/advisories/GHSA-x6g4-f6q3-fqvv.md)
  `GHSA-x6g4-f6q3-fqvv`, `BIT-nats-2026-33247`, `CVE-2026-33247`, `GO-2026-4827` · Go `github.com/nats-io/nats-server/v2`: affected `<2.11.15 || >=2.12.0-RC.1, <2.12.6`, fixed in `2.11.15`, `2.12.6` · CVSS 7.4 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-214, CWE-215
- [Coolify leaksensitive information \`email_change_code\` in \`/api/v1/teams/{team_id | current}/members\` API endpoint](https://agentprime.io/advisories/CVE-2025-59955.md)
  `CVE-2025-59955` · CVE record: coollabsio coolify · CVSS 5.7 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: Information disclosure, CWE-212, CWE-214
- [A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP applicati…](https://agentprime.io/advisories/CVE-2025-5452.md)
  `CVE-2025-5452` · CVE record: Axis Communications AB AXIS OS · CVSS 6.6 Medium · Not analysed yet · Published 11 Nov 2025 · Tags: CWE-214
- [F5OS-A FIPS HSM vulnerability](https://agentprime.io/advisories/CVE-2025-53860.md)
  `CVE-2025-53860` · CVE record: F5 F5OS - Appliance · CVSS 5.6 Medium · Not analysed yet · Published 15 Oct 2025 · Tags: CWE-214
- [BMC Control-M/Server cleartext database credentials in process lists and logs](https://agentprime.io/advisories/CVE-2025-48709.md)
  `CVE-2025-48709` · CVE record: BMC Control-M/Server · CVSS 4.8 Medium · Not analysed yet · Published 7 Aug 2025 · Tags: Information disclosure, CWE-214
- [IBM MQ Operator information disclosure](https://agentprime.io/advisories/CVE-2025-1333.md)
  `CVE-2025-1333` · CVE record: IBM MQ Operator · CVSS 6.0 Medium · Not analysed yet · Published 1 May 2025 · Tags: CWE-214
- [Arctera eDiscovery Platform: Arctera eDiscovery Platform before 10.3.2…](https://agentprime.io/advisories/CVE-2025-32987.md)
  `CVE-2025-32987` · CVE record: Arctera eDiscovery Platform · CVSS 6.0 Medium · Not analysed yet · Published 15 Apr 2025 · Tags: CWE-214
- [IBM QRadar Suite Software information disclosure](https://agentprime.io/advisories/CVE-2024-28799.md)
  `CVE-2024-28799` · CVE record: IBM QRadar Suite Software and 1 more · CVSS 5.6 Medium · Not analysed yet · Published 14 Aug 2024 · Tags: CWE-214
- [toy-blog administrative token leaked through the command line parameter](https://agentprime.io/advisories/CVE-2024-39314.md)
  `CVE-2024-39314` · CVE record: KisaragiEffective toy-blog · CVSS 4.7 Medium · Not analysed yet · Published 1 Jul 2024 · Tags: Information disclosure, CWE-214
- [Secrets Exfiltration in gradio-app/gradio](https://agentprime.io/advisories/CVE-2024-4254.md)
  `CVE-2024-4254` · CVE record: gradio-app gradio-app/gradio · CVSS 7.1 High · Not analysed yet · Published 4 Jun 2024 · Tags: CWE-214
- [Information disclosure in mk_oracle Checkmk agent plugin](https://agentprime.io/advisories/CVE-2024-1742.md)
  `CVE-2024-1742` · CVE record: Checkmk GmbH Checkmk · CVSS 3.8 Low · Not analysed yet · Published 22 Mar 2024 · Tags: CWE-214
- [Information disclosure in Cloudlinux OS cagefs](https://agentprime.io/advisories/CVE-2020-36771.md)
  `CVE-2020-36771` · CVE record: Cloudlinux OS cagefs · CVSS 7.8 High · Not analysed yet · Published 22 Jan 2024 · Tags: Information disclosure, CWE-214
- [Veracode Scan Jenkins Plugin vulnerable to information disclosure](https://agentprime.io/advisories/GHSA-fjrv-vx9m-4jpj.md)
  `GHSA-fjrv-vx9m-4jpj`, `CVE-2023-25722` · Maven `com.veracode.jenkins:veracode-scan`: affected `<23.3.19.0`, fixed in `23.3.19.0` · CVSS 5.5 Medium · Not analysed yet · Published 28 Mar 2023 · Tags: Information disclosure, CWE-214
- [Undertow vulnerable to Denial of Service (DoS) attacks](https://agentprime.io/advisories/GHSA-339q-62wm-c39w.md)
  `GHSA-339q-62wm-c39w`, `CVE-2021-3859` · Maven `io.undertow:undertow-core`: affected `<2.2.15`, fixed in `2.2.15` · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2022 · Tags: Denial of service, Information disclosure, CWE-214
- [CodeQL runner: Command-line options that make GitHub access tokens visible to other processes are now deprecated](https://agentprime.io/advisories/CVE-2021-32638.md)
  `CVE-2021-32638` · CVE record: github codeql-action · CVSS 4.4 Medium · Not analysed yet · Published 25 May 2021 · Tags: Information disclosure, CWE-214
- [Insertion of Sensitive Information into Log File, Invocation of Process Using Visible Sensitive Information, and Exposure of Sensitive Information to an Unauthorized Actor in Ansible](https://agentprime.io/advisories/GHSA-86hp-cj9j-33vv.md)
  `GHSA-86hp-cj9j-33vv`, `CVE-2020-1753`, `PYSEC-2020-210` · PyPI `ansible`: affected `>=2.7.0a1, <2.7.18 || >=2.8.0a1, <2.8.12 || >=2.9.0a1, <2.9.7`, fixed in `2.7.18`, `2.8.12`, `2.9.7` · CVSS 5.0 Medium · Not analysed yet · Published 7 Apr 2021 · Tags: Information disclosure, CWE-214
- [UAA password may appear in BOSH System Metrics Server process arguments](https://agentprime.io/advisories/CVE-2020-5422.md)
  `CVE-2020-5422` · CVE record: Cloud Foundry BOSH System Metrics Server · No CVSS score · Not analysed yet · Published 2 Oct 2020 · Tags: CWE-214
- [Red Hat Tower: When running Tower before 3.4.3 on OpenShift or Kubernetes…](https://agentprime.io/advisories/CVE-2019-3869.md)
  `CVE-2019-3869` · CVE record: Red Hat Tower · CVSS 7.2 High · Not analysed yet · Published 28 Mar 2019 · Tags: CWE-214
- [yast2-rmt leaks database passwords in process list](https://agentprime.io/advisories/CVE-2018-17957.md)
  `CVE-2018-17957` · CVE record: SUSE yast2-rmt · CVSS 3.4 Low · Not analysed yet · Published 26 Dec 2018 · Tags: CWE-214
- [Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-key...](https://agentprime.io/advisories/GHSA-hwrm-63v2-42g4.md)
  `GHSA-hwrm-63v2-42g4`, `CVE-2018-16837`, `PYSEC-2018-44` · PyPI `ansible`: affected `<2.5.11 || >=2.6, <2.6.7 || >=2.7, <2.7.1`, fixed in `2.5.11`, `2.6.7`, `2.7.1` · CVSS 7.8 High · Not analysed yet · Published 23 Oct 2018 · Tags: CWE-214

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-214>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-214/>. Everything for agents: <https://agentprime.io/llms.txt>.