By weakness (CWE)

CWE-201: related vulnerabilities

CVEs classified under CWE-201. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

19 published vulnerabilities

• CVE-2026-46481HIGH 8.3

  OpenMetadata users without admin privileges can exploit a workflow testing feature to extract sensitive credentials and authentication tokens. When a non-admin SSO user tests a database connection through the platform's automation interface, the response inadvertently exposes the plaintext database password and a privileged authentication token belonging to the ingestion bot. An attacker with these credentials can then impersonate the bot to access APIs and data that should be restricted to service accounts, effectively escalating their access within the metadata platform. This flaw affects all OpenMetadata versions prior to 1.12.4.

• CVE-2026-54848HIGH 8.3

  A flaw in the APIExperts Square for WooCommerce plugin allows sensitive information to be leaked when data is transmitted. An attacker can retrieve embedded sensitive data without authentication, affecting all versions through 4.7.3. This is a network-accessible vulnerability that requires no special privileges or user interaction to exploit.

• CVE-2026-4035HIGH 7.7

  MLflow, a popular open-source machine learning platform, contains a credential exposure vulnerability affecting versions before 3.11.0. The flaw allows attackers to extract sensitive server-side environment variables—such as AWS credentials—by manipulating how the AI Gateway handles secrets. An attacker with basic authentication access (or no authentication in default setups) can craft requests that trick MLflow into exposing these credentials to attacker-controlled endpoints. This is particularly dangerous because exposed cloud credentials could allow further compromise of artifact repositories and downstream systems.

• CVE-2026-42673HIGH 7.5

  Logtivity's Activity Logs plugin leaks sensitive information that should not be transmitted. The vulnerability allows unauthorized users to retrieve embedded sensitive data through the plugin's normal network communication channels. This affects all versions through 3.3.6 and requires patching to prevent data exposure.

• CVE-2026-44486HIGH 7.5

  Axios, a widely-used HTTP client library for JavaScript, has a credential leakage vulnerability in its Node.js implementation. When your application uses Axios to make requests through an authenticated proxy, the library can accidentally include proxy login credentials in subsequent requests if it follows a redirect to a different server. This happens because Axios retains the Proxy-Authorization header even when the redirected request no longer routes through the original proxy. Browser-based Axios applications are unaffected; only Node.js deployments with automatic redirect handling and proxy authentication are vulnerable.

• CVE-2026-44487HIGH 7.5

  Axios, a widely-used HTTP client library for Node.js and browsers, has a credential leakage vulnerability in its redirect-handling logic. When an application makes an HTTP request through an authenticated proxy and then follows a redirect to a destination that no longer requires the proxy, Axios may mistakenly send the proxy's authentication credentials to the final destination. An attacker controlling or observing that final destination could capture credentials intended only for the proxy, potentially gaining unauthorized access to internal proxy infrastructure. This flaw affects Axios versions before 0.32.0 and 1.16.0.

• CVE-2026-49064HIGH 7.5

  Stiofan GetPaid contains a flaw that causes the application to inadvertently leak sensitive information in outgoing data transmissions. An unauthenticated remote attacker can retrieve this embedded sensitive data without requiring special privileges or user interaction. The vulnerability affects GetPaid versions up to and including 2.8.49.

• CVE-2026-49082HIGH 7.4

  Chatway Live Chat — an AI-powered customer support and chat plugin — contains a flaw in versions 1.4.8 and earlier that exposes sensitive subscriber data to attackers with valid login credentials. An authenticated user can access information they shouldn't have permission to view, potentially including customer communications, support tickets, or account details. This is particularly concerning because Chatway is commonly deployed on WordPress sites handling customer interactions, making the exposed data valuable to both external attackers and malicious insiders.

• CVE-2026-52698HIGH 7.4

  PushEngage, a WordPress plugin for web push notifications and eCommerce automation, contains a flaw that exposes sensitive subscriber data to authenticated users with low privileges. Versions 4.2.3 and earlier are affected. An attacker with a user account on the WordPress site could access subscriber information they shouldn't be able to view, such as email addresses, preferences, or other PII collected through the push notification system. This is not a public exploit scenario—it requires an existing login—but it significantly increases risk if your WordPress environment has multiple user accounts or contractor access.

• CVE-2024-35690MEDIUM 6.5

  CVE-2024-35690 is a data exposure vulnerability in MarketingFire's Widget Options plugin. The flaw allows authenticated users to retrieve sensitive information that should not be transmitted over the network. An attacker with valid login credentials can extract embedded sensitive data by exploiting how the plugin handles and sends data. This is not a remote unauthenticated attack, but the exposure of sensitive information through a trusted plugin represents a meaningful risk to organizations relying on MarketingFire.

• CVE-2026-22551MEDIUM 6.5

  Eclipse Theia, a browser-based IDE platform, contains a vulnerability in its AI chat feature that allows attackers to exfiltrate sensitive workspace data. When a user opens a malicious or compromised workspace and interacts with the AI chat, an attacker can inject prompts that trick the AI into generating Markdown image tags pointing to attacker-controlled servers. Because Theia automatically renders these images by fetching them from arbitrary URLs, the attacker can encode sensitive information—such as file contents, API keys, or conversation history—in the image URL itself, effectively stealing it. This requires user interaction (opening a workspace and using AI chat) but no special privileges. The risk is elevated in environments where developers regularly open workspaces from untrusted or semi-trusted sources.

• CVE-2026-42539MEDIUM 6.5

  IRIS is a web-based platform used by incident response teams to collaborate and share technical details during security investigations. A vulnerability in versions before 2.4.28 causes the platform to leak sensitive information to authenticated users that those users should not have access to. This happens because the application returns unnecessary data in responses, exposing information beyond what the client application actually needs to function. An attacker with valid IRIS credentials can exploit this to view restricted incident data.

• CVE-2026-44653MEDIUM 6.5

  LibreChat versions up to 0.8.3 expose sensitive credentials to users with view-only access to MCP (Model Context Protocol) servers. When a user with limited permissions queries the server configuration API, they receive plaintext API keys and OAuth secrets that should remain encrypted and admin-only. This breaks the intended access control model where viewers should never see the credentials needed to authenticate with external AI providers. An attacker with even basic read access can steal these secrets and impersonate the legitimate service.

• CVE-2026-45582MEDIUM 6.5

  n8n-MCP, an AI assistant integration layer for the n8n workflow automation platform, fails to fully sanitize sensitive data before transmitting workflow information to its telemetry backend. The flaw allows fragments of URLs and embedded credentials—such as API keys, tenant IDs, and signed request parameters—to leak into the project's anonymous telemetry collection. This occurs when users configure HTTP-Request-style nodes with sensitive parameters in their URLs. The vulnerability affects versions before 2.51.3, where the telemetry sanitizer was enhanced to properly redact these values before transmission.

• CVE-2026-55180MEDIUM 6.5

  pnpm, a widely-used Node.js package manager, has a credential leakage vulnerability in versions before 10.34.2 and 11.5.3. When a developer clones or installs a malicious repository, pnpm will expand environment variable placeholders (like ${API_KEY}) found in the repository's .npmrc or pnpm-workspace.yaml files. These expanded values—which may contain sensitive credentials or secrets—are then sent to an attacker-controlled package registry during dependency resolution, before any build scripts run. A developer with access to systems containing environment secrets is the attack vector; the attacker needs the victim to work with a malicious repository.

• CVE-2026-7184MEDIUM 6.5

  Mattermost Server contains a flaw in how it processes certain administrative API requests that allows authenticated users with specific permissions to extract security credentials used for remote cluster connections. An attacker with the 'manage_secure_connections' permission can craft a specially designed API request to retrieve authentication tokens that should remain protected. This affects versions 11.6.1 and earlier, 11.5.4 and earlier, and 10.11.15 and earlier.

• CVE-2026-10101MEDIUM 6.3

  ACM/MCE (Advanced Cluster Management / Multicluster Engine) inadvertently exposes container registry credentials in InfraEnv status messages when pull-secret validation fails. A user with read-only namespace access can view InfraEnv objects and extract the full `.dockerconfigjson` payload—including usernames, passwords, and base64-encoded authentication tokens—despite having no direct permission to read Secrets. This circumvents Kubernetes RBAC controls designed to keep registry credentials confidential.

• CVE-2026-49370LOW 3.4

  JetBrains YouTrack versions before 2026.1.13162 contain an information disclosure vulnerability affecting the fetchApp request handler. An authenticated user with high privileges can trigger unintended data exposure through a request that includes user interaction, though the scope of disclosed information is limited. This is a low-severity issue that requires administrative or privileged account access to exploit.

• CVE-2026-45739LOW 3.1

  Strawberry GraphQL, a popular library for building GraphQL APIs, has a flaw in its bundled GraphiQL interface (versions 0.288.4 through 0.315.3) where sensitive headers entered by developers are inadvertently exposed in the browser URL. When a developer pastes an authorization token or other credential into the GraphiQL headers editor, that value becomes part of the page URL and persists in browser history, shareable links, and server access logs. This creates a credential leakage risk if someone gains access to those logs or if links are shared. The issue has been patched in version 0.315.4.