# CWE-402.

Every Advisory and CVE whose sources give the weakness CWE-402, newest first.

## Records, newest first

- [Myhoard logs backup encryption key in plain text](https://agentprime.io/advisories/CVE-2025-67745.md)
  `CVE-2025-67745` · CVE record: Aiven-Open myhoard · CVSS 7.1 High · Not analysed yet · Published 18 Dec 2025 · Tags: CWE-402
- [Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted UDP packets.](https://agentprime.io/advisories/CVE-2024-32388.md)
  `CVE-2024-32388` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: CWE-402, CWE-940
- [trytond allows remote attackers to obtain sensitive trace-back (server setup) information](https://agentprime.io/advisories/GHSA-jqfc-9q34-prhg.md)
  `GHSA-jqfc-9q34-prhg`, `CVE-2025-66422`, `PYSEC-2026-1990` · PyPI `trytond`: affected `<6.0.70 || >=7.0.0, <7.0.40 || >=7.1.0, <7.4.21 || >=7.5.0, <7.6.11`, fixed in `6.0.70`, `7.0.40`, `7.4.21`, `7.6.11` · CVSS 4.3 Medium · Not analysed yet · Published 30 Nov 2025 · Tags: CWE-402
- [StarDict: The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian…](https://agentprime.io/advisories/CVE-2025-55014.md)
  `CVE-2025-55014` · CVE record: StarDict StarDict · CVSS 4.7 Medium · Not analysed yet · Published 4 Aug 2025 · Tags: CWE-402
- [Plesk Obsidian: In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS…](https://agentprime.io/advisories/CVE-2025-49618.md)
  `CVE-2025-49618` · CVE record: Plesk Obsidian · CVSS 5.8 Medium · Not analysed yet · Published 3 Jul 2025 · Tags: CWE-402
- [OneLogin Active Directory Connector: In One Identity OneLogin Active Directory Connector before 6.1.5…](https://agentprime.io/advisories/CVE-2025-52925.md)
  `CVE-2025-52925` · CVE record: OneLogin Active Directory Connector · CVSS 5.0 Medium · Not analysed yet · Published 2 Jul 2025 · Tags: CWE-402
- [Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking](https://agentprime.io/advisories/GHSA-wjrh-hj83-3wh7.md)
  `GHSA-wjrh-hj83-3wh7`, `CVE-2025-48383`, `PYSEC-2026-1300` · PyPI `django-select2`: affected `<8.4.1`, fixed in `8.4.1` · CVSS 8.2 High · Not analysed yet · Published 27 May 2025 · Tags: Server-side request forgery (SSRF), CWE-402
- [In Zammad 6.4.x before 6.4.2, there is information exposure.](https://agentprime.io/advisories/CVE-2025-32360.md)
  `CVE-2025-32360` · CVE record: Zammad Zammad · CVSS 4.2 Medium · Not analysed yet · Published 5 Apr 2025 · Tags: CWE-402
- [XWiki allows unregistered users to access private pages information through REST endpoint](https://agentprime.io/advisories/GHSA-22q5-9phm-744v.md)
  `GHSA-22q5-9phm-744v`, `CVE-2025-29925` · Maven `org.xwiki.platform:xwiki-platform-rest-server`: affected `>=1.9M1, <15.10.14 || >=16.0.0-rc-1, <16.4.6 || >=16.5.0-rc-1, <16.10.0-rc-1`, fixed in `15.10.14`, `16.4.6`, `16.10.0-rc-1` · CVSS 8.7 High · Not analysed yet · Published 19 Mar 2025 · Tags: CWE-402
- [Transmission of Private Resources into a New Sphere in Crafter Engine](https://agentprime.io/advisories/CVE-2025-0502.md)
  `CVE-2025-0502` · CVE record: CrafterCMS CrafterCMS · CVSS 6.9 Medium · Not analysed yet · Published 15 Jan 2025 · Tags: CWE-402
- [Ruijie Reyee OS Resource Leak](https://agentprime.io/advisories/CVE-2024-47146.md)
  `CVE-2024-47146` · CVE record: Ruijie Reyee OS · CVSS 7.1 High · Not analysed yet · Published 6 Dec 2024 · Tags: CWE-402
- [@electron/packager's build process memory potentially leaked into final executable](https://agentprime.io/advisories/GHSA-34h3-8mw4-qw57.md)
  `GHSA-34h3-8mw4-qw57`, `CVE-2024-29900` · npm `@electron/packager`: affected `>=18.3.0, <18.3.1`, fixed in `18.3.1` · CVSS 7.5 High · Not analysed yet · Published 29 Mar 2024 · Tags: CWE-402
- [Kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline.](https://agentprime.io/advisories/CVE-2024-0443.md)
  `CVE-2024-0443` · CVE record: Red Hat Red Hat Enterprise Linux 8 and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 11 Jan 2024 · Tags: CWE-402
- [Instack-undercloud: rsync leaks information to undercloud](https://agentprime.io/advisories/CVE-2022-3596.md)
  `CVE-2022-3596` · CVE record: Red Hat Red Hat OpenStack Platform 13.0 - ELS and 1 more · CVSS 7.5 High · Not analysed yet · Published 20 Sept 2023 · Tags: CWE-402
- [Kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c](https://agentprime.io/advisories/CVE-2023-4569.md)
  `CVE-2023-4569` · CVE record: Kernel and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 28 Aug 2023 · Tags: CWE-402
- [Obfuscated email addresses should not be sorted](https://agentprime.io/advisories/GHSA-g9w4-prf3-m25g.md)
  `GHSA-g9w4-prf3-m25g`, `CVE-2023-38509` · Maven `org.xwiki.platform:xwiki-platform-livetable-ui`: affected `>=3.5-milestone-1, <14.10.9 || >=15.0, <15.3-rc-1`, fixed in `14.10.9`, `15.3-rc-1` · CVSS 4.3 Medium · Not analysed yet · Published 27 Jul 2023 · Tags: CWE-402
- [XWiki Platform may retrieve email addresses of all users](https://agentprime.io/advisories/GHSA-7vr7-cghh-ch63.md)
  `GHSA-7vr7-cghh-ch63`, `CVE-2023-34467` · Maven `org.xwiki.platform:xwiki-platform-livetable-ui`: affected `>=3.5-milestone-1, <14.4.8 || >=14.5, <14.10.4`, fixed in `14.4.8`, `14.10.4` · CVSS 7.5 High · Not analysed yet · Published 20 Jun 2023 · Tags: Information disclosure, CWE-402
- [A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6).](https://agentprime.io/advisories/CVE-2022-30231.md)
  `CVE-2022-30231` · CVE record: Siemens SICAM GridEdge (Classic) · CVSS 6.9 Medium · Not analysed yet · Published 14 Jun 2022 · Tags: CWE-402
- [Exposure of Resource to Wrong Sphere in org.craftercms:crafter-search](https://agentprime.io/advisories/GHSA-2wr2-8qjq-gh55.md)
  `GHSA-2wr2-8qjq-gh55`, `CVE-2021-23264` · Maven `org.craftercms:crafter-search`: affected `>=3.1.0, <3.1.15`, fixed in `3.1.15` · CVSS 8.1 High · Not analysed yet · Published 16 Dec 2021 · Tags: Information disclosure, CWE-402
- [Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter Engine](https://agentprime.io/advisories/CVE-2021-23263.md)
  `CVE-2021-23263` · CVE record: Crafter Software Crafter CMS · CVSS 5.9 Medium · Not analysed yet · Published 2 Dec 2021 · Tags: CWE-402
- [Project sources exposure in Vaadin Designer](https://agentprime.io/advisories/CVE-2021-31410.md)
  `CVE-2021-31410` · CVE record: Vaadin Designer · CVSS 8.6 High · Not analysed yet · Published 23 Apr 2021 · Tags: CWE-402
- [OSGi applications using Vaadin 12-14 and 19 vulnerable to server classes and resources exposure](https://agentprime.io/advisories/GHSA-25xc-jwfq-39jw.md)
  `GHSA-25xc-jwfq-39jw`, `CVE-2021-31407` · Maven `com.vaadin:flow-server`: affected `>=1.2.0, <2.4.8 || >=6.0.0, <6.0.1`, fixed in `2.4.8`, `6.0.1` · CVSS 8.6 High · Not analysed yet · Published 19 Apr 2021 · Tags: Information disclosure, CWE-402
- [Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19](https://agentprime.io/advisories/GHSA-j9wr-49vq-rm5g.md)
  `GHSA-j9wr-49vq-rm5g` · Maven `com.vaadin:vaadin-bom`: affected `>=12.0.0, <14.4.10 || >=19.0.0, <19.0.1`, fixed in `14.4.10`, `19.0.1` · CVSS 8.6 High · Not analysed yet · Published 19 Apr 2021 · Tags: CWE-402
- [Elasticsearch X-Pack Security: Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled…](https://agentprime.io/advisories/CVE-2017-8442.md)
  `CVE-2017-8442` · CVE record: Elastic Elasticsearch X-Pack Security · No CVSS score · Not analysed yet · Published 7 Jul 2017 · Tags: CWE-402

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-402>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-402/>. Everything for agents: <https://agentprime.io/llms.txt>.