# CWE-257. Every Advisory and CVE whose sources give the weakness CWE-257, newest first. ## Records, newest first - [Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format](https://agentprime.io/advisories/CVE-2026-28745.md) `CVE-2026-28745` · CVE record: Red Lion Controls 700 Series · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: CWE-257 - [Improperly Stored Credentials](https://agentprime.io/advisories/CVE-2026-103548.md) `CVE-2026-103548` · CVE record: Itron MV-90 xi · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: CWE-257, CWE-260, CWE-261 - [Windows DHCP Server Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-69297.md) `CVE-2026-69297` · CVE record: Microsoft Windows 10 Version 1607 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: CWE-257 - [Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage of a Password vulnerability.](https://agentprime.io/advisories/CVE-2026-80176.md) `CVE-2026-80176` · CVE record: Dell Secure Connect Gateway 5.0 - Application and 1 more · CVSS 4.7 Medium · Not analysed yet · Published 7 Sept 2026 · Tags: CWE-257 - [Storage of passwords in a reversible format](https://agentprime.io/advisories/CVE-2026-65309.md) `CVE-2026-65309` · CVE record: ANDRITZ HIPASE-250 and 1 more · CVSS 7.5 High · Not analysed yet · Published 31 Jul 2026 · Tags: Weak cryptography or TLS, CWE-257 - [Stored credentials in Redmine](https://agentprime.io/advisories/CVE-2026-1836.md) `CVE-2026-1836` · CVE record: Redmine Redmine · CVSS 5.3 Medium · Not analysed yet · Published 12 Jun 2026 · Tags: CWE-257 - [Fortinet FortiSOAR PaaS: A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS…](https://agentprime.io/advisories/CVE-2026-22574.md) `CVE-2026-22574` · CVE record: Fortinet FortiSOAR PaaS and 1 more · CVSS 4.1 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-257 - [Fortinet FortiSOAR on-premise: A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS…](https://agentprime.io/advisories/CVE-2026-22576.md) `CVE-2026-22576` · CVE record: Fortinet FortiSOAR on-premise and 1 more · CVSS 4.1 Medium · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-257 - [Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge](https://agentprime.io/advisories/CVE-2025-8095.md) `CVE-2025-8095` · CVE record: Progress Software Corporation OpenEdge · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Apr 2026 · Tags: CWE-257 - [Hirschmann HiLCOS Classic Platform Password Exposure via SNMP](https://agentprime.io/advisories/CVE-2016-15058.md) `CVE-2016-15058` · CVE record: Belden Hirschmann HiLCOS Classic Platform · CVSS 8.6 High · Not analysed yet · Published 3 Apr 2026 · Tags: CWE-257 - [Eaton EasySoft: The encryption mechanism used in Eaton's EasySoft project file was insecure and…](https://agentprime.io/advisories/CVE-2026-22614.md) `CVE-2026-22614` · CVE record: Eaton EasySoft · CVSS 6.1 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-257 - [RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)](https://agentprime.io/advisories/CVE-2026-30785.md) `CVE-2026-30785` · CVE record: rustdesk-client RustDesk Client · CVSS 8.2 High · Not analysed yet · Published 5 Mar 2026 · Tags: Weak cryptography or TLS, Prototype pollution, CWE-257, CWE-323 - [Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-20128.md) `CVE-2026-20128` · CVE record: Cisco Cisco Catalyst SD-WAN Manager · CVSS 7.5 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 25 Feb 2026 · Tags: CWE-257 - [Use of a hardcoded static key to protect sensitive data in Explorance Blue](https://agentprime.io/advisories/CVE-2025-57796.md) `CVE-2025-57796` · CVE record: Explorance Blue · CVSS 6.8 Medium · Not analysed yet · Published 28 Jan 2026 · Tags: CWE-257 - [Automated Logic WebCTRL and Carrier i-Vu Session Fixation](https://agentprime.io/advisories/CVE-2025-14295.md) `CVE-2025-14295` · CVE record: Automated Logic WebCTRL and 1 more · CVSS 7.0 High · Not analysed yet · Published 22 Jan 2026 · Tags: CWE-257 - [Recoverable passwords in Asseco Infomedica Plus](https://agentprime.io/advisories/CVE-2025-8307.md) `CVE-2025-8307` · CVE record: Asseco InfoMedica Plus · CVSS 5.9 Medium · Not analysed yet · Published 8 Jan 2026 · Tags: CWE-257 - [NetSupport Manager < 14.12.0001 Gateway Key Reversible Encoding Credential Recovery](https://agentprime.io/advisories/CVE-2025-34180.md) `CVE-2025-34180` · CVE record: NetSupport Software Manager · CVSS 8.4 High · Not analysed yet · Published 15 Dec 2025 · Tags: CWE-257 - [A vulnerability has been identified in SiPass integrated (All versions < V3.0).](https://agentprime.io/advisories/CVE-2025-40774.md) `CVE-2025-40774` · CVE record: Siemens SiPass integrated · CVSS 6.7 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-257 - [Newforma Info Exchange (NIX) insufficiently protected credentials](https://agentprime.io/advisories/CVE-2025-35054.md) `CVE-2025-35054` · CVE record: Newforma Project Center · CVSS 4.8 Medium · Not analysed yet · Published 9 Oct 2025 · Tags: Hard-coded credentials, Information disclosure, CWE-257 - [HCL Compass is affected by a security vulnerability](https://agentprime.io/advisories/CVE-2025-0280.md) `CVE-2025-0280` · CVE record: HCL Software Compass · CVSS 7.5 High · Not analysed yet · Published 3 Sept 2025 · Tags: CWE-257 - [XWiki PDF export jobs store sensitive cookies unencrypted in job statuses](https://agentprime.io/advisories/GHSA-9m7c-m33f-3429.md) `GHSA-9m7c-m33f-3429`, `CVE-2025-58049` · Maven `org.xwiki.platform:xwiki-platform-export-pdf-api`: affected `>=14.4.2, <16.4.8 || >=16.5.0-rc-1, <16.10.7 || >=17.0.0-rc-1, <17.4.0-rc-1`, fixed in `16.4.8`, `16.10.7`, `17.4.0-rc-1` · CVSS 5.8 Medium · Not analysed yet · Published 28 Aug 2025 · Tags: CWE-212, CWE-257 - [Vulnerability in Initial Administrator Login Process](https://agentprime.io/advisories/CVE-2025-57789.md) `CVE-2025-57789` · CVE record: Commvault CommCell · CVSS 5.3 Medium · Not analysed yet · Published 20 Aug 2025 · Tags: CWE-257 - [Privilege escalation issue in Amazon EMR Secret Agent component](https://agentprime.io/advisories/CVE-2025-8904.md) `CVE-2025-8904` · CVE record: Amazon EMR · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2025 · Tags: CWE-257 - [RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format.](https://agentprime.io/advisories/CVE-2025-44958.md) `CVE-2025-44958` · CVE record: RUCKUS Network Director · CVSS 5.3 Medium · Not analysed yet · Published 4 Aug 2025 · Tags: CWE-257 - [Improper Encryption in Ivanti Endpoint Manager](https://agentprime.io/advisories/CVE-2025-6996.md) `CVE-2025-6996` · CVE record: Ivanti Endpoint Manager · CVSS 8.4 High · Not analysed yet · Published 8 Jul 2025 · Tags: CWE-257 - [Improper Encryption in Ivanti Endpoint Manager](https://agentprime.io/advisories/CVE-2025-6995.md) `CVE-2025-6995` · CVE record: Ivanti Endpoint Manager · CVSS 8.4 High · Not analysed yet · Published 8 Jul 2025 · Tags: CWE-257 - [CVE-2025-27459](https://agentprime.io/advisories/CVE-2025-27459.md) `CVE-2025-27459` · CVE record: Endress+Hauser Endress+Hauser MEAC300-FNADE4 · CVSS 4.4 Medium · Not analysed yet · Published 3 Jul 2025 · Tags: CWE-257 - [Weak Password Storage](https://agentprime.io/advisories/CVE-2024-51552.md) `CVE-2024-51552` · CVE record: ABB ASPECT-Enterprise and 2 more · CVSS 7.1 High · Not analysed yet · Published 22 May 2025 · Tags: CWE-257 - [An issue in Macro-video Technologies Co.,Ltd V380 Pro android application 2.1.44 and V380 Pro android application 2.1.64 allows an attacker to obtain sensitive information via the QE code based shari…](https://agentprime.io/advisories/CVE-2025-25983.md) `CVE-2025-25983` · CVE record · CVSS 3.4 Low · Not analysed yet · Published 18 Apr 2025 · Tags: CWE-257, CWE-656 - [Fortinet FortiOS: A storing passwords in a recoverable format in Fortinet FortiOS 7.4.0 through 7.4.8…](https://agentprime.io/advisories/CVE-2024-32122.md) `CVE-2024-32122` · CVE record: Fortinet FortiOS · CVSS 2.1 Low · Not analysed yet · Published 8 Apr 2025 · Tags: CWE-257 - [Inaba Denki Sangyo Co., Ltd. CHOCO TEI WATCHER mini…: Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini…](https://agentprime.io/advisories/CVE-2025-24852.md) `CVE-2025-24852` · CVE record: Inaba Denki Sangyo Co., Ltd. CHOCO TEI WATCHER mini (IB-MCT001) · CVSS 4.6 Medium · Not analysed yet · Published 31 Mar 2025 · Tags: CWE-257 - [Privilege Escalation in SIMPLE.ERP](https://agentprime.io/advisories/CVE-2024-8774.md) `CVE-2024-8774` · CVE record: Simple SA SIMPLE.ERP · CVSS 7.7 High · Not analysed yet · Published 24 Mar 2025 · Tags: CWE-257 - [User passwords are decrypted and stored on memory before any user logged in.](https://agentprime.io/advisories/CVE-2024-32151.md) `CVE-2024-32151` · CVE record: Sharp Corporation Multiple MFPs (multifunction printers) and 1 more · CVSS 5.9 Medium · Not analysed yet · Published 26 Nov 2024 · Tags: CWE-257 - [Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2024-20462.md) `CVE-2024-20462` · CVE record: Cisco Cisco Analog Telephone Adaptor (ATA) Software · CVSS 5.5 Medium · Not analysed yet · Published 16 Oct 2024 · Tags: Information disclosure, CWE-257 - [TopQuadrant TopBraid EDG password manager stores external credentials insecurely](https://agentprime.io/advisories/CVE-2024-45744.md) `CVE-2024-45744` · CVE record: TopQuadrant TopBraid EDG · CVSS 3.0 Low · Not analysed yet · Published 27 Sept 2024 · Tags: Information disclosure, CWE-257 - [WP Mail SMTP <= 4.0.1 - Authenticated (Admin+) SMTP Password Exposure](https://agentprime.io/advisories/CVE-2024-6694.md) `CVE-2024-6694` · CVE record: smub WP Mail SMTP by WPForms – The Most Popular SMTP and Email Log Plugin · CVSS 2.7 Low · Not analysed yet · Published 20 Jul 2024 · Tags: CWE-257 - [American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - stored web interface](https://agentprime.io/advisories/CVE-2024-32932.md) `CVE-2024-32932` · CVE record: Johnson Controls American Dynamics Illustra Essentials Gen 4 · CVSS 6.8 Medium · Not analysed yet · Published 2 Jul 2024 · Tags: CWE-257 - [American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - Linux](https://agentprime.io/advisories/CVE-2024-32756.md) `CVE-2024-32756` · CVE record: Johnson Controls American Dynamics Illustra Essentials Gen 4 · CVSS 6.8 Medium · Not analysed yet · Published 2 Jul 2024 · Tags: CWE-257 - [Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI](https://agentprime.io/advisories/CVE-2024-3073.md) `CVE-2024-3073` · CVE record: smub Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, Office 365, Outlook, Custom SMTP, and more · CVSS 2.7 Low · Not analysed yet · Published 13 Jun 2024 · Tags: CWE-257 - [CyberPower PowerPanel business Storing Passwords in a Recoverable Format](https://agentprime.io/advisories/CVE-2024-32042.md) `CVE-2024-32042` · CVE record: CyberPower PowerPanel business · CVSS 4.9 Medium · Not analysed yet · Published 15 May 2024 · Tags: CWE-257 - [LoadMaster Reversible Password Encryption Algorithm](https://agentprime.io/advisories/CVE-2024-3543.md) `CVE-2024-3543` · CVE record: Progress Software Corporation LoadMaster · CVSS 6.4 Medium · Not analysed yet · Published 2 May 2024 · Tags: CWE-257 - [Claris FileMaker Server: Claris International has successfully resolved an issue of potentially exposing password…](https://agentprime.io/advisories/CVE-2023-42955.md) `CVE-2023-42955` · CVE record: Claris FileMaker Server · CVSS 6.1 Medium · Not analysed yet · Published 26 Apr 2024 · Tags: CWE-257 - [Unitronics Vision Standard Unauthenticated Password Retrieval](https://agentprime.io/advisories/CVE-2024-1480.md) `CVE-2024-1480` · CVE record: Unitronics Vision230 and 4 more · CVSS 7.5 High · Not analysed yet · Published 19 Apr 2024 · Tags: CWE-257 - [IBM OpenPages with Watson information disclosure](https://agentprime.io/advisories/CVE-2023-38738.md) `CVE-2023-38738` · CVE record: IBM OpenPages with Watson · CVSS 6.8 Medium · Not analysed yet · Published 19 Jan 2024 · Tags: CWE-257 - [IBM Security Access Manager Container information disclosure](https://agentprime.io/advisories/CVE-2023-31001.md) `CVE-2023-31001` · CVE record: IBM Security Verify Access Appliance and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 11 Jan 2024 · Tags: CWE-257 - [Incorrect Implementation of Authentication Algorithm Vulnerability](https://agentprime.io/advisories/CVE-2023-5627.md) `CVE-2023-5627` · CVE record: Moxa NPort 6000 Series · CVSS 7.5 High · Not analysed yet · Published 1 Nov 2023 · Tags: Authentication bypass, Weak cryptography or TLS, CWE-257 - [Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format](https://agentprime.io/advisories/CVE-2023-2358.md) `CVE-2023-2358` · CVE record: Hitachi Vantara Pentaho Business Analytics Server · CVSS 4.3 Medium · Not analysed yet · Published 26 Sept 2023 · Tags: CWE-257 - [Alaris Infusion Central: The Alaris Infusion Central software, versions 1.1 to 1.3.2…](https://agentprime.io/advisories/CVE-2022-47376.md) `CVE-2022-47376` · CVE record: Alaris Infusion Central · CVSS 7.3 High · Not analysed yet · Published 13 Jun 2023 · Tags: CWE-257 - [Pimcore customers' list user password hash is disclosed](https://agentprime.io/advisories/GHSA-j65r-g7q2-f8v3.md) `GHSA-j65r-g7q2-f8v3`, `CVE-2023-2881`, `PKSA-kq1d-6py7-szwx` · Packagist `pimcore/customer-management-framework-bundle`: affected `<3.3.10`, fixed in `3.3.10` · CVSS 6.7 Medium · Not analysed yet · Published 25 May 2023 · Tags: Hard-coded credentials, CWE-257 - [Storing Passwords in a Recoverable Format](https://agentprime.io/advisories/CVE-2023-31150.md) `CVE-2023-31150` · CVE record: Schweitzer Engineering Laboratories SEL-3505 and 4 more · CVSS 8.0 High · Not analysed yet · Published 10 May 2023 · Tags: CWE-257 - [Azure Machine Learning Compute Instance Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2023-23382.md) `CVE-2023-23382` · CVE record: Microsoft Azure Machine Learning · CVSS 6.5 Medium · Not analysed yet · Published 14 Feb 2023 · Tags: CWE-257 - [Schneider Electric Data Center Expert: A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could…](https://agentprime.io/advisories/CVE-2022-32519.md) `CVE-2022-32519` · CVE record: Schneider Electric Data Center Expert · CVSS 8.0 High · Not analysed yet · Published 30 Jan 2023 · Tags: CWE-257 - [Windows Credential Manager User Interface Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2023-21726.md) `CVE-2023-21726` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Not analysed yet · Published 10 Jan 2023 · Tags: CWE-257 - [Affected devices store the CLI user passwords encrypted in flash memory.](https://agentprime.io/advisories/CVE-2022-46142.md) `CVE-2022-46142` · CVE record: Siemens RUGGEDCOM RM1224 LTE(4G) EU and 4 more · CVSS 5.2 Medium · Not analysed yet · Published 13 Dec 2022 · Tags: CWE-257 - [cSRX Series: Storing Passwords in a Recoverable Format and software permissions issues allows a local attacker to elevate privileges](https://agentprime.io/advisories/CVE-2022-22251.md) `CVE-2022-22251` · CVE record: Juniper Networks Junos OS · CVSS 7.8 High · Not analysed yet · Published 18 Oct 2022 · Tags: CWE-257, CWE-275 - [ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control](https://agentprime.io/advisories/CVE-2022-34838.md) `CVE-2022-34838` · CVE record: ABB ABB Zenon · CVSS 8.1 High · Not analysed yet · Published 24 Aug 2022 · Tags: CWE-257 - [ABB Ability TM Operations Data Management Zenon Zenon Log Server file access control](https://agentprime.io/advisories/CVE-2022-34837.md) `CVE-2022-34837` · CVE record: ABB ABB Zenon · CVSS 6.2 Medium · Not analysed yet · Published 24 Aug 2022 · Tags: CWE-257 - [Jenkins Credentials Binding Plugin Stores Passwords in a Recoverable Format](https://agentprime.io/advisories/GHSA-j7gw-mwfg-vqf4.md) `GHSA-j7gw-mwfg-vqf4`, `CVE-2019-1010241` · Maven `org.jenkins-ci.plugins:credentials-binding`: affected `=1.17`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 24 May 2022 · Tags: Hard-coded credentials, CWE-257 - [User Credentials Stored in a Recoverable Format within Fidelis Network and Deception](https://agentprime.io/advisories/CVE-2021-35050.md) `CVE-2021-35050` · CVE record: Fidelis Cybersecurity Fidelis Network and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 25 Jun 2021 · Tags: CWE-257 - [ZOLL Defibrillator Dashboard: ZOLL Defibrillator Dashboard, v prior to 2.2,The application allows users to store their…](https://agentprime.io/advisories/CVE-2021-27485.md) `CVE-2021-27485` · CVE record: ZOLL Defibrillator Dashboard · No CVSS score · Not analysed yet · Published 16 Jun 2021 · Tags: CWE-257 Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .