Cleartext Storage of Sensitive Information in an Environment Variable

Every one of the 23 is a mark on the map. Named now: 1 to 23, most at risk first.

1. Ecava IntegraXor SCADA Server Information Exposure Through Environmental VariablesCVE-2014-2377Ecava · CVSS 5 · 1.8% likely

   Ecava

2. Quarkus: build env information disclosure via gradle pluginCVE-2023-5720Quarkus · CVSS 7.7 · 1.0% likely

   Quarkus

3. Shescape potential environment variable exposure on Windows with CMDCVE-2023-35931ericcornelissen · CVSS 3.1 · 0.8% likely

   Ericcornelissen

4. Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variablesCVE-2024-11736Red Hat · CVSS 4.9 · 0.8% likely

   Red Hat

5. In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parametersCVE-2026-49377JetBrains · CVSS 4.3 · 0.7% likely

   JetBrains

6. Cluster-image-registry-operator: exposes a secret via env variable in pod definition on azureCVE-2024-4369Red Hat · CVSS 6.8 · 0.7% likely

   Red Hat

7. Org.keycloak/keycloak-model-storage-service: variable injection into environment variablesCVE-2025-9162Keycloak · CVSS 4.9 · 0.6% likely

   Keycloak

8. A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.CVE-2025-28381Openc3 · CVSS 7.5 · 0.5% likely

   OpenC3

9. IBM Storage Virtualize vSphere Remote Plug-in information disclosureCVE-2023-43029IBM · CVSS 6.8 · 0.4% likely

   IBM

10. Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information DisclosureCVE-2026-72648Elastic · CVSS 6.5 · 0.4% likely

    Elastic

11. Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment InheritanceCVE-2026-77938letta-ai · CVSS 6.5 · 0.4% likely

    Letta-Ai

12. mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via BubblewrapEnvironmentCVE-2026-108592SWE-agent · CVSS 5.3 · 0.3% likely
13. Quarkus-core: leak of local configuration properties into quarkus applicationsCVE-2024-2700Redhat · CVSS 7 · 0.3% likely

    Red Hat

14. IBM Controller Information DisclosureCVE-2025-36017IBM · CVSS 6.5 · 0.3% likely

    IBM

15. PraisonAIAgents Affected by Environment Variable Secret Exfiltration via os.path.expandvars() Bypassing shell=False in Shell ToolCVE-2026-40153MervinPraison · CVSS 7.4 · 0.3% likely

    MervinPraison

16. IBM MQ information disclosureCVE-2025-0985IBM · CVSS 5.5 · 0.3% likely

    IBM

17. Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and WindowsCVE-2025-27899IBM · CVSS 5.3 · 0.2% likely

    IBM

18. A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Teli…CVE-2023-47615Telit Cinterion · CVSS 3.3 · 0.2% likely

    Telit Cinterion

19. python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command InjectionCVE-2026-45370universal-tool-calling-protocol · CVSS 7.7 · 0.2% likely

    Universal-Tool-Calling-Protocol

20. OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)CVE-2026-54146tinyhumansai · CVSS 8.8 · 0.2% likely

    Tinyhumansai

21. Improper Authentication in Tapandsign Technologies Tap and Sign AppCVE-2024-12604Tapandsign Technologies · CVSS 6.5 · 0.2% likely
22. Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable ExposureCVE-2026-76227renovatebot · CVSS 5.5 · 0.2% likely

    Renovatebot

23. IBM Planning Analytics Advanced Certified Containers is vulnerable to a sensitive information disclosure vulnerabilityCVE-2025-36105IBM · CVSS 4.4 · 0.1% likely

    IBM

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.