CWE-214.

nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command line

• nvm
• CWE-214

pgAdmin 4: Server passwords are left in pgAdmin's process environment

• pgadmin.org pgAdmin 4
• CWE-214
• CWE-526

Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java

• AWS amazon-kinesis-producer
• Information disclosure
• CWE-214

Infinispan-operator: infinispan operator: sensitive information disclosure due pod args store

• Red Hat Data Grid 8
• CWE-214

Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line arguments

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-214

Cockpit-machines: cockpit-appstream: rhsm access-token disclosure through image helper command-line arguments

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-214

Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-214

wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments

• Canonical Ubuntu Pro for WSL
• CWE-214

microsandbox: Secret values exposed in world-readable process arguments

• CWE-214

<0.5.10 · fixed in 0.5.10

Cockpit-machines: cockpit-machines: sensitive data exposure via command-line arguments

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-214

Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process list

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-214

Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process arguments

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-214

In openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8, the desktop GUI passes the steganography password to the CLI child process on the command line via the --stego-password argument ...

• CWE-214

<1.4.9 · fixed in 1.4.9

Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listings

• Red Hat Ceph Storage 5
• Red Hat Ceph Storage 9
• CWE-214

NVIDIA NemoClaw: NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of…

• NVIDIA NemoClaw
• CWE-214

Black Duck blackduck-c-cpp: Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp…

• Black Duck blackduck-c-cpp
• CWE-214

Exposure of OTP Secret Through Process Command-Line Arguments in TÜBİTAK BİLGEM's eta-otp-lock

• TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock
• CWE-214

GitPython: Environment-variable exfiltration via Repo.create_remote() / Remote.add() URL (incomplete fix of GHSA-rwj8-pgh3-r573)

• Information disclosure
• CWE-214

<3.1.55 · fixed in 3.1.55

Tanium addressed an information disclosure vulnerability in Connect.

• Tanium Connect
• CWE-214

ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command Line

• Canonical ubuntu-pro-client (ubuntu-advantage-tools)
• Canonical Ubuntu 26.04 LTS
• CWE-214

Sensitive Data Exposure in TUBITAK BILGEM's Pardus Domain Joiner

• TUBITAK BILGEM Software Technologies Research Institute Pardus Domain Joiner
• CWE-214

PraisonAI Vulnerable to Sensitive Environment Variable Exposure via Untrusted MCP Subprocess Execution

• Information disclosure
• CWE-214

<4.5.128 · fixed in 4.5.128

OpenClaw: SSH-based sandbox backends pass unsanitized process.env to child processes

• CWE-212
• CWE-214

<2026.3.31 · fixed in 2026.3.31

openssl-encrypt has visible password in process list via --password CLI argument

• CWE-214
• CWE-256

<1.4.0 · fixed in 1.4.0

NATS credentials are exposed in monitoring port via command-line argv

• CWE-214
• CWE-215

<2.11.15 || >=2.12.0-RC.1, <2.12.6 · fixed in 2.11.15, 2.12.6

Coolify leaksensitive information `email_change_code` in `/api/v1/teams/{team_id | current}/members` API endpoint

• coollabsio coolify
• Information disclosure
• CWE-212

A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the malicious ACAP applicati…

• Axis Communications AB AXIS OS
• CWE-214

F5OS-A FIPS HSM vulnerability

• F5OS - Appliance
• CWE-214

BMC Control-M/Server cleartext database credentials in process lists and logs

• BMC Control-M/Server
• Information disclosure
• CWE-214

IBM MQ Operator information disclosure

• IBM MQ Operator
• CWE-214

Arctera eDiscovery Platform: Arctera eDiscovery Platform before 10.3.2…

• Arctera eDiscovery Platform
• CWE-214

IBM QRadar Suite Software information disclosure

• IBM QRadar Suite Software
• IBM Cloud Pak for Security
• CWE-214

toy-blog administrative token leaked through the command line parameter

• KisaragiEffective toy-blog
• Information disclosure
• CWE-214

Secrets Exfiltration in gradio-app/gradio

• gradio-app/gradio
• CWE-214

Information disclosure in mk_oracle Checkmk agent plugin

• Checkmk
• CWE-214

Information disclosure in Cloudlinux OS cagefs

• Cloudlinux OS cagefs
• Information disclosure
• CWE-214

Veracode Scan Jenkins Plugin vulnerable to information disclosure

• Information disclosure
• CWE-214

<23.3.19.0 · fixed in 23.3.19.0

Undertow vulnerable to Denial of Service (DoS) attacks

• Denial of service
• Information disclosure

<2.2.15 · fixed in 2.2.15

CodeQL runner: Command-line options that make GitHub access tokens visible to other processes are now deprecated

• github codeql-action
• Information disclosure
• CWE-214

Insertion of Sensitive Information into Log File, Invocation of Process Using Visible Sensitive Information, and Exposure of Sensitive Information to an Unauthorized Actor in Ansible

• Information disclosure
• CWE-214

>=2.7.0a1, <2.7.18 || >=2.8.0a1, <2.8.12 || >=2.9.0a1, <2.9.7 · fixed in 2.7.18, 2.8.12, 2.9.7

UAA password may appear in BOSH System Metrics Server process arguments

• Cloud Foundry BOSH System Metrics Server
• CWE-214

Red Hat Tower: When running Tower before 3.4.3 on OpenShift or Kubernetes…

• Red Hat Tower
• CWE-214

yast2-rmt leaks database passwords in process list

• SUSE yast2-rmt
• CWE-214

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-key...

• CWE-214

<2.5.11 || >=2.6, <2.6.7 || >=2.7, <2.7.1 · fixed in 2.5.11, 2.6.7, 2.7.1