An API key is hardcoded and retrievable from the application package. Since Android applications...
CVE-2026-103097
An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineer
#cwe-312
共收录 131 条相关情报。
← 返回所有主题API key is hardcoded and retrievable from the application package. Since Android applications can...
CVE-2026-103096
API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered,
An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the c...
CVE-2026-103097
An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineer
API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the clie...
CVE-2026-103096
API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered,
Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external id...
CVE-2026-100288
Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attack
heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext...
CVE-2026-100862
heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0
heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secrets include webhook header-auth value...
CVE-2026-100862
heym 是一个工作流自动化平台，在 0.0.91 之前的版本中存在敏感信息明文存储与泄露漏洞。多个能力密钥（capability secrets）被以明文形式存储，并在接口响应、执行历史或日志中返回。具体包括：webhook 的 head
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing...
CVE-2026-67221
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-
A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown code of the file ssm_pro/src/main/java/c...
CVE-2026-96549
A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, OAuthConfig writes a plaintext fallback file containing acc...
CVE-2026-77250
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, OA
MCP Atlassian: OAuth fallback token storage writes plaintext access and refresh tokens with group-readable permissions
CVE-2026-77250
MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, OA
Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Applications that enable this feature can...
CVE-2026-93764
Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level enc
A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encr...
CVE-2026-93763
A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that
AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets
CVE-2026-63406
### Summary The telemetry subsystem embeds a hardcoded auth token (`"secret"`) in the public source and transmits raw CL
CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a d...
CVE-2026-81321
CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker w
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemetry subsystem in telemetry/config.go enables tracking with...
CVE-2026-63406
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemet
AnyCable: Telemetry Subsystem Contains Hardcoded Authentication Token and Transmits CLI Arguments Including Secrets
CVE-2026-63406
AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the telemet
The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attac...
CVE-2026-44940
The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecu
Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the device to retrieve the ...
CVE-2026-86443
Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an
A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/Login_M...
CVE-2026-90842
A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown f