Skip to content
CVE Tracker

CWE-312: Cleartext storage of sensitive information

897 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

All 897 in the listAtom feed of new CVEsWhat CWE-312 is, at MITRE (opens in a new tab)
Published CVEs
897
Last 12 months
171
Critical
52
Known exploited
2

Critical 52High 294Medium 497Low 53Not scored 1

CVEs per yearBy the year they were published

  1. 20202
  2. 20206
  3. 2022106
  4. 202212
  5. 202388
  6. 20235
  7. 2024115
  8. 2025113
  9. 202591
  10. 2026132
  11. 2026114
  12. 202666

Known exploitedNewest addition to KEV first

  • CVE-2023-22894

    Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can…

    Product not named

    ExploitedHigh7.2
  • CVE-2011-4723

    The D-Link DIR-300 router stores cleartext passwords, which allows context-dependent attackers to obtain sensitive information via unspecified vectors.

    Product not named

    ExploitedMedium5.7

Newest CVEs

  • CVE-2026-114551

    MailEnable Auth Cleartext Storage Information Disclosure Vulnerability

    MailEnable · MailEnable

    Medium5.9
  • CVE-2026-120733

    Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the…

    Devolutions · Server

    Not scored
  • CVE-2026-114217

    Konflux-ci: github token plaintext exposure in ci/cd scripts

    konflux-ci

    High8.6
  • CVE-2026-110200

    Langflow OSS is affected by multiple vulnerabilities

    IBM · Langflow OSS

    Medium6.5
  • CVE-2026-116691

    MLflow CrewAI autologging records LLM provider API keys in logged trace spans

    mlflow · mlflow

    Medium6.5
  • CVE-2026-77054

    Cleartext Storage of Sensitive Information in boneIO

    boneIO · boneIO

    Medium6.9
  • CVE-2026-115400

    crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens

    crawlseo · crawlseo

    Medium6.7
  • CVE-2026-96293

    Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File

    WatchGuard · WatchGuard Agent

    Medium6.9
  • CVE-2026-114223

    NewType Infortech｜NT OneAPP - Exposure of Sensitive Information

    NewType Infortech · NT OneAPP

    Medium6.7
  • CVE-2025-7203

    Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials

    WSO2 · WSO2 Universal Gateway

    Medium4.9

Vendors it comes up for most

  1. IBM58
  2. Jenkins Project42
  3. Dell21
  4. Red Hat13
  5. Siemens12
  6. Splunk12
  7. Brocade11
  8. Fortinet9
  9. Cisco8
  10. Apache Software Foundation7