# CWE-256.

Every Advisory and CVE whose sources give the weakness CWE-256, newest first.

## Records, newest first

- [Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences](https://agentprime.io/advisories/CVE-2026-111491.md)
  `CVE-2026-111491` · CVE record: TPC Software Matchpoint · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: CWE-256
- [Plaintext Storage of LDAP Password in Axxon One Shared Configuration](https://agentprime.io/advisories/CVE-2026-121021.md)
  `CVE-2026-121021` · CVE record: AxxonSoft Axxon One · CVSS 6.8 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: CWE-256
- [Clear Text Storage of Password in Crypttech's Vatos DLP](https://agentprime.io/advisories/CVE-2026-86715.md)
  `CVE-2026-86715` · CVE record: Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: CWE-256
- [Cleartext Storage of OAuth Credentials in ServiceNow AI Platform](https://agentprime.io/advisories/CVE-2026-103094.md)
  `CVE-2026-103094` · CVE record: ServiceNow ServiceNow AI Platform · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: CWE-256
- [Autotune: kruize/autotune: kruize/autotune: datasources credential disclosure](https://agentprime.io/advisories/CVE-2026-110975.md)
  `CVE-2026-110975` · CVE record · CVSS 7.4 High · Not analysed yet · Published 23 Oct 2026 · Tags: CWE-256
- [Plaintext storage of a password in WebCTI](https://agentprime.io/advisories/CVE-2026-63315.md)
  `CVE-2026-63315` · CVE record: Slican IPx · CVSS 8.2 High · Not analysed yet · Published 15 Oct 2026 · Tags: CWE-256
- [Plaintext password storage in Dell Command | Configure (DCC)](https://agentprime.io/advisories/CVE-2026-70414.md)
  `CVE-2026-70414` · CVE record: Dell Command | Configure (DCC) · CVSS 5.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: CWE-256
- [Plane: Plaintext logging of API token](https://agentprime.io/advisories/CVE-2026-104892.md)
  `CVE-2026-104892` · CVE record: makeplane plane · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: CWE-256
- [IBM Guardium Data Protection is affected by multiple vulnerabilities.](https://agentprime.io/advisories/CVE-2026-84884.md)
  `CVE-2026-84884` · CVE record: IBM Guardium Data Protection · CVSS 7.5 High · Not analysed yet · Published 25 Sept 2026 · Tags: CWE-256
- [Security Advisory 0168](https://agentprime.io/advisories/CVE-2026-2380.md)
  `CVE-2026-2380` · CVE record: Arista Networks EOS · CVSS 5.1 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: CWE-256
- [Plaintext password storage in Contec Co., Ltd. Remote I/O Coupler Unit (Server Type) CPSN-MCB271-\* and others](https://agentprime.io/advisories/CVE-2026-82783.md)
  `CVE-2026-82783` · CVE record: Contec Co., Ltd. Remote I/O Coupler Unit (Server Type) CPSN-MCB271-\* and 2 more · CVSS 4.1 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: CWE-256
- [Plaintext Storage of User Credentials in Menulux Software's Menulux Portal](https://agentprime.io/advisories/CVE-2026-19051.md)
  `CVE-2026-19051` · CVE record: Menulux Software Inc. Menulux Portal · CVSS 7.1 High · Not analysed yet · Published 4 Sept 2026 · Tags: CWE-256
- [Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)](https://agentprime.io/advisories/CVE-2026-15933.md)
  `CVE-2026-15933` · CVE record: OptimiDoc OptimiDoc Server · CVSS 6.9 Medium · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-256
- [HDD Password Stored In Plaintext](https://agentprime.io/advisories/CVE-2021-38489.md)
  `CVE-2021-38489` · CVE record: Insyde Software InsydeH2O · CVSS 8.2 High · Not analysed yet · Published 3 Sept 2026 · Tags: CWE-256
- [rust-iot-platform Cleartext Password Storage via User Model](https://agentprime.io/advisories/CVE-2026-82453.md)
  `CVE-2026-82453` · CVE record: iot-ecology rust-iot-platform · CVSS 8.7 High · Not analysed yet · Published 29 Aug 2026 · Tags: CWE-256
- [CloudNativePG: Cleartext role passwords recorded in pg_stat_statements allow privileged tenant roles to recover the PostgreSQL superuser credential and achieve RCE in the database pod](https://agentprime.io/advisories/CVE-2026-55765.md)
  `CVE-2026-55765` · CVE record: cloudnative-pg cloudnative-pg · CVSS 8.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Hard-coded credentials, CWE-256
- [Plaintext password storage in Streamsoft Business Intelligence](https://agentprime.io/advisories/CVE-2026-50641.md)
  `CVE-2026-50641` · CVE record: Streamsoft Business Intelligence · CVSS 7.1 High · Not analysed yet · Published 29 Jul 2026 · Tags: CWE-256
- [Hard-coded admin credentials in Quick.Cart](https://agentprime.io/advisories/CVE-2026-41874.md)
  `CVE-2026-41874` · CVE record: OpenSolution Quick.Cart · CVSS 6.8 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: CWE-256
- [Weintek cMT3092X Plaintext Storage of a Password](https://agentprime.io/advisories/CVE-2026-61886.md)
  `CVE-2026-61886` · CVE record: Weintek cMT3092X firmware and 1 more · CVSS 7.1 High · Not analysed yet · Published 24 Jul 2026 · Tags: CWE-256
- [Plaintext Storage of a Password in Panduit IntraVUE by Pronetiqs](https://agentprime.io/advisories/CVE-2026-40430.md)
  `CVE-2026-40430` · CVE record: Pronetiqs Panduit Intravue · CVSS 8.7 High · Not analysed yet · Published 23 Jul 2026 · Tags: CWE-256
- [Ansible-lightspeed: ansible lightspeed extension for visual studio code: information disclosure of google gemini api key](https://agentprime.io/advisories/CVE-2026-44187.md)
  `CVE-2026-44187` · CVE record: Red Hat Red Hat Ansible Automation Platform 2 · CVSS 3.3 Low · Not analysed yet · Published 22 Jul 2026 · Tags: CWE-256
- [Frogman: API tokens stored in plaintext](https://agentprime.io/advisories/CVE-2026-46513.md)
  `CVE-2026-46513` · CVE record: mwtcmi frogman · CVSS 7.4 High · Not analysed yet · Published 16 Jul 2026 · Tags: CWE-256
- [Insecure password storage in User directory](https://agentprime.io/advisories/CVE-2026-14867.md)
  `CVE-2026-14867` · CVE record: arcinfo PcVue · CVSS 6.8 Medium · Not analysed yet · Published 7 Jul 2026 · Tags: CWE-256
- [Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding](https://agentprime.io/advisories/GHSA-4j9m-h44m-2hv8.md)
  `GHSA-4j9m-h44m-2hv8`, `CVE-2026-50268` · NuGet `Steeltoe.Configuration.Encryption`: affected `>=4.0.0, <4.2.0`, fixed in `4.2.0` · CVSS 1.9 Low · Not analysed yet · Published 2 Jul 2026 · Tags: Weak cryptography or TLS, CWE-256
- [motionEye: Authentication possible via password hash](https://agentprime.io/advisories/GHSA-r3cw-c95m-wfh9.md)
  `GHSA-r3cw-c95m-wfh9`, `CVE-2026-46488`, `PYSEC-2026-428` · PyPI `motioneye`: affected `<0.44.0`, fixed in `0.44.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jun 2026 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-256, CWE-836
- [Lemur user-update path stores plaintext passwords](https://agentprime.io/advisories/GHSA-q437-g7fv-2jvv.md)
  `GHSA-q437-g7fv-2jvv`, `CVE-2026-55164`, `PYSEC-2026-2587` · PyPI `lemur`: affected `<1.9.2`, fixed in `1.9.2` · CVSS 4.9 Medium · Not analysed yet · Published 25 Jun 2026 · Tags: CWE-256
- [Jenkins FitNesse Plugin stores passwords unencrypted](https://agentprime.io/advisories/GHSA-j4ph-wp3c-c37w.md)
  `GHSA-j4ph-wp3c-c37w`, `CVE-2026-57302` · Maven `org.jenkins-ci.plugins:fitnesse`: affected `<=1.36`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2026 · Tags: CWE-256
- [Plaintext password storage in Dell EMC VxRail Appliance](https://agentprime.io/advisories/CVE-2024-39575.md)
  `CVE-2024-39575` · CVE record: Dell Dell EMC VxRail Appliance · CVSS 7.4 High · Not analysed yet · Published 16 Jun 2026 · Tags: CWE-256
- [IBM Security QRadar EDR Software has a vulnerability where user credentials may be stored in plain text, potentially exposing sensitive information.](https://agentprime.io/advisories/CVE-2024-45636.md)
  `CVE-2024-45636` · CVE record: IBM Security QRadar EDR · CVSS 4.1 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-256
- [GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial console.](https://agentprime.io/advisories/CVE-2026-36174.md)
  `CVE-2026-36174` · CVE record · CVSS 4.6 Medium · Not analysed yet · Published 4 Jun 2026 · Tags: CWE-256
- [Heatmiser Wifi Thermostat 1.7 Credential Disclosure via networkSetup.htm](https://agentprime.io/advisories/CVE-2018-25396.md)
  `CVE-2018-25396` · CVE record: Heatmiser Heatmiser Wifi Thermostat · CVSS 8.7 High · Not analysed yet · Published 29 May 2026 · Tags: CWE-256
- [Prometheus Azure AD remote write OAuth client secret exposed via config API](https://agentprime.io/advisories/GHSA-wg65-39gg-5wfj.md)
  `GHSA-wg65-39gg-5wfj`, `BIT-prometheus-2026-42151`, `CVE-2026-42151`, `GO-2026-5710` · Go `github.com/prometheus/prometheus`: affected `>=0.45.2, <0.311.3`, fixed in `0.311.3` · CVSS 7.5 High · Not analysed yet · Published 5 May 2026 · Tags: Information disclosure, CWE-256
- [Plaintext password storage in ILM Informatique OpenConcerto](https://agentprime.io/advisories/CVE-2026-6500.md)
  `CVE-2026-6500` · CVE record: ILM Informatique OpenConcerto · CVSS 4.8 Medium · Not analysed yet · Published 4 May 2026 · Tags: CWE-256
- [Vulnerabilities found](https://agentprime.io/advisories/CVE-2025-36335.md)
  `CVE-2025-36335` · CVE record: IBM watsonx.data intelligence · CVSS 6.2 Medium · Not analysed yet · Published 30 Apr 2026 · Tags: CWE-256
- [Langflow has an Information Leak through Incomplete API Key Redaction](https://agentprime.io/advisories/GHSA-5jjf-wcvf-923w.md)
  `GHSA-5jjf-wcvf-923w`, `CVE-2026-6597`, `PYSEC-2026-2565` · PyPI `langflow`: affected `<=1.8.3`, no fixed version yet · CVSS 5.1 Medium · Not analysed yet · Published 20 Apr 2026 · Tags: CWE-255, CWE-256
- [Plaintext Storage of a Password in Sparx Pro Cloud Server.](https://agentprime.io/advisories/CVE-2025-15624.md)
  `CVE-2025-15624` · CVE record: Sparx Systems Pty Ltd. Sparx Pro Cloud Server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Apr 2026 · Tags: CWE-256
- [Plaintext password storage in Synology SSL VPN Client](https://agentprime.io/advisories/CVE-2021-47961.md)
  `CVE-2021-47961` · CVE record: Synology Synology SSL VPN Client · CVSS 8.1 High · Not analysed yet · Published 10 Apr 2026 · Tags: CWE-256
- [Plaintext storage of a password in OpenPLC_V3](https://agentprime.io/advisories/CVE-2026-35556.md)
  `CVE-2026-35556` · CVE record: OpenPLC_V3 OpenPLC_V3 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Apr 2026 · Tags: CWE-256
- [openssl-encrypt has visible password in process list via --password CLI argument](https://agentprime.io/advisories/GHSA-h3m5-p59h-x88p.md)
  `GHSA-h3m5-p59h-x88p`, `CVE-2026-74873`, `PYSEC-2026-3753` · PyPI `openssl-encrypt`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 8.7 High · Not analysed yet · Published 31 Mar 2026 · Tags: CWE-214, CWE-256
- [IBM InfoSphere Information Server is vulnerable due to plaintext storage of a password](https://agentprime.io/advisories/CVE-2025-36258.md)
  `CVE-2025-36258` · CVE record: IBM InfoSphere Information Server · CVSS 7.1 High · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-256
- [NATS has MQTT plaintext password disclosure](https://agentprime.io/advisories/GHSA-v722-jcv5-w7mc.md)
  `GHSA-v722-jcv5-w7mc`, `BIT-nats-2026-33216`, `CVE-2026-33216`, `GO-2026-4836` · Go `github.com/nats-io/nats-server` and 1 more: affected `*`, no fixed version yet · CVSS 8.6 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-213, CWE-256
- [Plaintext Storage of Credentials in Configuration Backup in Nexxt Nebula 300+](https://agentprime.io/advisories/CVE-2026-31850.md)
  `CVE-2026-31850` · CVE record: Nexxt Solutions Nebula 300+ · CVSS 6.8 Medium · Not analysed yet · Published 23 Mar 2026 · Tags: CWE-256
- [CityData CityChat ai.citydata.citychat credentials.json credentials storage](https://agentprime.io/advisories/CVE-2026-4251.md)
  `CVE-2026-4251` · CVE record: CityData CityChat · CVSS 2.0 Low · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-255, CWE-256
- [Albert Sağlık Hizmetleri ve Ticaret Albert Health Google Cloud Service Account Key service-account.json credentials storage](https://agentprime.io/advisories/CVE-2026-4250.md)
  `CVE-2026-4250` · CVE record: Albert Sağlık Hizmetleri ve Ticaret Albert Health · CVSS 2.0 Low · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-255, CWE-256
- [La Nacion App app.lanacion.activity BuildConfig.java credentials storage](https://agentprime.io/advisories/CVE-2026-4243.md)
  `CVE-2026-4243` · CVE record: La Nacion App · CVSS 2.0 Low · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-255, CWE-256
- [BabyChakra Pregnancy & Parenting App app.babychakra.babychakra Configuration.java credentials storage](https://agentprime.io/advisories/CVE-2026-4242.md)
  `CVE-2026-4242` · CVE record: BabyChakra Pregnancy & Parenting App · CVSS 2.0 Low · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-255, CWE-256
- [XREAL Nebula App ai.nreal.nebula.universal CloudStoragePlugin.java credentials storage](https://agentprime.io/advisories/CVE-2026-4217.md)
  `CVE-2026-4217` · CVE record: XREAL Nebula App · CVSS 2.0 Low · Not analysed yet · Published 16 Mar 2026 · Tags: CWE-255, CWE-256
- [Plaintext password storage in Dell Device Management Agent (DDMA)](https://agentprime.io/advisories/CVE-2026-22285.md)
  `CVE-2026-22285` · CVE record: Dell Device Management Agent (DDMA) · CVSS 4.4 Medium · Not analysed yet · Published 4 Mar 2026 · Tags: CWE-256
- [An issue in the reset_pj.cgi endpoint of Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 allows unauthorized attackers to execute arbitrary commands via supplying a crafted GET request.](https://agentprime.io/advisories/CVE-2024-55026.md)
  `CVE-2024-55026` · CVE record · CVSS 8.8 High · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-256
- [NocoDB has Plaintext Storage of Shared View Passwords](https://agentprime.io/advisories/GHSA-mpp2-x7wv-38hv.md)
  `GHSA-mpp2-x7wv-38hv`, `CVE-2026-28360` · npm `nocodb`: affected `<0.301.3`, fixed in `0.301.3` · CVSS 2.7 Low · Not analysed yet · Published 2 Mar 2026 · Tags: CWE-256
- [Johnson Controls-Frick Quantum HD-Hardcoded Email Credentials Saved as Plaintext in Firmware](https://agentprime.io/advisories/CVE-2026-21660.md)
  `CVE-2026-21660` · CVE record: Johnson Controls Frick Controls Quantum HD · CVSS 6.9 Medium · Not analysed yet · Published 27 Feb 2026 · Tags: CWE-256
- [IBM Db2 Information Disclosure](https://agentprime.io/advisories/CVE-2025-36425.md)
  `CVE-2025-36425` · CVE record: IBM Db2 for Linux, UNIX and Windows · CVSS 5.3 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: CWE-256
- [Plaintext password display in Quick.Cart](https://agentprime.io/advisories/CVE-2026-23797.md)
  `CVE-2026-23797` · CVE record: OpenSolution Quick.Cart · CVSS 6.9 Medium · Not analysed yet · Published 5 Feb 2026 · Tags: CWE-256
- [GUnet OpenEclass 1.7.3 E-learning platform - Plaintext Password Storage](https://agentprime.io/advisories/CVE-2020-37115.md)
  `CVE-2020-37115` · CVE record: Openeclass GUnet OpenEclass · CVSS 7.1 High · Not analysed yet · Published 3 Feb 2026 · Tags: CWE-256
- [Brocade SANnav DataBase plaintext password is logged in failover logs (CVE-2025-12680)](https://agentprime.io/advisories/CVE-2025-12680.md)
  `CVE-2025-12680` · CVE record: Brocade SANnav · CVSS 6.0 Medium · Not analysed yet · Published 2 Feb 2026 · Tags: Information disclosure, CWE-256
- [Plaintext password storage in Dell CloudBoost Virtual Appliance](https://agentprime.io/advisories/CVE-2026-21417.md)
  `CVE-2026-21417` · CVE record: Dell CloudBoost Virtual Appliance · CVSS 7.0 High · Not analysed yet · Published 27 Jan 2026 · Tags: CWE-256
- [AutomationDirect CLICK Programmable Logic Controller Plaintext Storage of a Password](https://agentprime.io/advisories/CVE-2025-25051.md)
  `CVE-2025-25051` · CVE record: AutomationDirect CLICK Programmable Logic Controller · CVSS 6.1 Medium · Not analysed yet · Published 22 Jan 2026 · Tags: CWE-256
- [Ksenia Security lares Home Automation 1.6 Remote Code Execution via MPFS Upload](https://agentprime.io/advisories/CVE-2025-15113.md)
  `CVE-2025-15113` · CVE record: Ksenia Security S.p.A. lares · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Dec 2025 · Tags: CWE-256
- [ZKTeco BioTime Endpoint safe_setting credentials storage](https://agentprime.io/advisories/CVE-2025-15128.md)
  `CVE-2025-15128` · CVE record: ZKTeco BioTime · CVSS 6.9 Medium · Not analysed yet · Published 28 Dec 2025 · Tags: CWE-255, CWE-256
- [Beward Intercom 2.3.1 Local Credentials Disclosure via Unencrypted Database](https://agentprime.io/advisories/CVE-2018-25130.md)
  `CVE-2018-25130` · CVE record: Beward R&D Co., Ltd BEWARD Intercom · CVSS 6.8 Medium · Not analysed yet · Published 24 Dec 2025 · Tags: CWE-256

Older: <https://agentprime.io/advisories/tag/cwe-256.md?cursor=WyIyMDI1LTEyLTI0VDE5OjI3OjQzLjc1MjAwMFoiLCJDVkUtMjAxOC0yNTEzMCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-256>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-256/>. Everything for agents: <https://agentprime.io/llms.txt>.