CWE-526

CVEs per yearBy the year they were published

1. 20141
2. 20233
3. 20242
4. 20257
5. 202610

Newest CVEs

• CVE-2026-116246

  pgAdmin 4: Server passwords are left in pgAdmin's process environment

  pgadmin.org · pgAdmin 4

  High7.0
• CVE-2026-77938

  Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance

  letta-ai · letta

  High7.1
• CVE-2026-108592

  mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironment

  SWE-agent · mini-swe-agent

  Medium6.0
• CVE-2026-76227

  Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure

  renovatebot · renovate

  Medium6.8
• CVE-2026-72648

  Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure

  Elastic · Eck Operator

  Medium6.5
• CVE-2026-49377

  In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters

  JetBrains · TeamCity

  Medium4.3
• CVE-2026-45370

  python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection

  universal-tool-calling-protocol · python-utcp

  High7.7
• CVE-2026-40153

  PraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell Tool

  MervinPraison · PraisonAIAgents

  High7.4
• CVE-2025-36105

  IBM Planning Analytics Advanced Certified Containers is vulnerable to a sensitive information disclosure vulnerability

  IBM · Planning Analytics Advanced Certified Containers

  Medium4.4
• CVE-2025-27899

  Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows

  IBM · DB2 Recovery Expert for LUW

  Medium5.3

Vendors it comes up for most

1. IBM5
2. Red Hat4
3. Ecava1
4. Elastic1
5. JetBrains1
6. Keycloak1
7. MervinPraison1
8. SWE-agent1
9. Tapandsign Technologies1
10. Telit Cinterion1