Skip to content
OpenAdvisories

Weakness (CWE)

CWE-522: Insufficiently Protected Credentials

Class Incomplete

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

How to prevent it (3 mitigations)

  1. Architecture and Design

    Use an appropriate security mechanism to protect the credentials.

  2. Architecture and Design

    Make appropriate use of cryptography to protect the credentials.

  3. Implementation

    Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).

Source: MITRE CWE-522

All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 8.2
    CVE-2026-116244 Public exploit

    pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials

    When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operating-system account r…

    pgadmin.org pgAdmin 4
  • High 7.5
    CVE-2026-36436 Public exploit

    An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative config…

  • High 7.5
    CVE-2026-104850 Public exploit

    MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server

    MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authoriza…

    modelcontextprotocol typescript-sdk @modelcontextprotocol/sdk @modelcontextprotocol/client npm
  • High 8.2
    CVE-2026-104051 Public exploit

    PictShare < 3.7.1 Sensitive Information Disclosure via info API

    PictShare before 3.7.1 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the secret delete_code and uploader metadata by calling the API::info() endpoint which returns the complete raw metadata object without a f…

    HaschekSolutions PictShare
  • High 7.7
    CVE-2026-32606 Public exploit

    IncusOS has a LUKS encryption bypass due to insufficient TPM policy

    IncusOS is an immutable OS image dedicated to running Incus. Prior to 202603142010, the default configuration of systemd-cryptenroll as used by IncusOS through mkosi allows for an attacker with physical access to the machine to access the encrypted data witho…

    lxc incus-os github.com/lxc/incus-os/incus-osd Go
  • High 7.3
    CVE-2025-34078 Public exploit

    NSClient++ 0.5.2.35 Local Privilege Escalation via ExternalScripts and Web Interface

    A local privilege escalation vulnerability exists in NSClient++ 0.5.2.35 when both the web interface and ExternalScripts features are enabled. The configuration file (nsclient.ini) stores the administrative password in plaintext and is readable by local users…

    NSClient++ NSClient++
  • High 7.1
    CVE-2025-46820 Public exploit

    phpgt/Dom exposes the GITHUB_TOKEN in Dom workflow run artifact

    phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the c…

    phpgt Dom
  • High 7.5
    CVE-2024-23733 Public exploit

    The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Cor…

  • High 8.6
    CVE-2024-0368 Public exploit

    Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys

    The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extr…

    wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups Web / CMS
  • High 8.6
    CVE-2022-1026 Public exploit EPSS 15%

    Kyocera Net View Address Book Exposure

    Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.

    KYOCERA Multifunction Printer Net Viewer
  • High 7.5
    CVE-2018-18074 Public exploit

    Insufficiently Protected Credentials in Requests

    The Requests package before 2.20.0 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.

    python-pip requests requests requests Debian Ubuntu PyPI
  • High 8.8
    CVE-2014-1812 Exploited · Ransomware Public exploit EPSS 65%

    The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Wind…

    KEV Nov 3, 2021