CWE-214 · Information Disclosure
Invocation of Process Using Visible Sensitive Information
40CVEs
SortMost likely exploited
40 CVEs with CWE-214 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2021-3859A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attack…Redhat · undertow · 2022-08-26 | – | 1.8% | 2022-08-26 |
| CVE-2019-3869When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability t…Red Hat · Tower · CVSS 7.2 · 2019-03-28 | 7.2 | 1.3% | 2019-03-28 |
| CVE-2020-5422UAA password may appear in BOSH System Metrics Server process argumentsCloud Foundry · BOSH System Metrics Server · 2020-10-02 | – | 0.9% | 2020-10-02 |
| CVE-2020-1753A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7,…Red Hat · Ansible · CVSS 5 · 2020-03-16 | 5.0 | 0.5% | 2020-03-16 |
| CVE-2020-36771CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a command line argument. In some configurations this allows local users to view the authentication token via…Cloudlinux OS · cagefs · CVSS 7.8 · 2024-01-22 | 7.8 | 0.5% | 2024-01-22 |
| CVE-2024-4254Secrets Exfiltration in gradio-app/gradiogradio-app · gradio-app/gradio · CVSS 7.1 · 2024-06-04 | 7.1 | 0.5% | 2024-06-04 |
| CVE-2021-32638CodeQL runner: Command-line options that make GitHub access tokens visible to other processes are now deprecatedgithub · codeql-action · CVSS 4.4 · 2021-05-25 | 4.4 | 0.4% | 2021-05-25 |
| CVE-2018-17957yast2-rmt leaks database passwords in process listSUSE · yast2-rmt · CVSS 3.4 · 2018-12-26 | 3.4 | 0.4% | 2018-12-26 |
| CVE-2018-16837Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a paramet…Redhat · Ansible · CVSS 7.8 · 2018-10-23 | 7.8 | 0.4% | 2018-10-23 |
| CVE-2026-74873openssl_encrypt before 1.4.0 Password Exposure via CLI Argumentjahlives · openssl_encrypt · CVSS 5.5 · 2026-08-17 | 5.5 | 0.3% | 2026-08-17 |
| CVE-2025-5452A malicious ACAP application can gain access to admin-level service account credentials used by legitimate ACAP applications, leading to potential privilege escalation of the mali…Axis Communications AB · AXIS OS · CVSS 6.6 · 2025-11-11 | 6.6 | 0.3% | 2025-11-11 |
| CVE-2024-28799IBM QRadar Suite Software information disclosureIBM · QRadar Suite Software · CVSS 5.6 · 2024-08-14 | 5.6 | 0.3% | 2024-08-14 |
| CVE-2026-92171Infinispan-operator: infinispan operator: sensitive information disclosure due pod args storeRed Hat · Red Hat Data Grid 8 · CVSS 6.5 · 2026-10-26 | 6.5 | 0.3% | 2026-10-26 |
| CVE-2025-1333IBM MQ Operator information disclosureIBM · MQ Operator · CVSS 6 · 2025-05-01 | 6.0 | 0.3% | 2025-05-01 |
| CVE-2024-1742Information disclosure in mk_oracle Checkmk agent pluginCheckmk GmbH · Checkmk · CVSS 3.8 · 2024-03-22 | 3.8 | 0.2% | 2024-03-22 |
| CVE-2026-116246pgAdmin 4: Server passwords are left in pgAdmin's process environmentpgadmin.org · pgAdmin 4 · CVSS 6.5 · 2026-10-30 | 6.5 | 0.2% | 2026-10-30 |
| CVE-2024-39314toy-blog administrative token leaked through the command line parameterKisaragiEffective · toy-blog · CVSS 4.7 · 2024-07-01 | 4.7 | 0.2% | 2024-07-01 |
| CVE-2026-40159PraisonAI Exposes Sensitive Environment Variable via Untrusted MCP Subprocess ExecutionMervinPraison · PraisonAI · CVSS 5.5 · 2026-04-10 | 5.5 | 0.2% | 2026-04-10 |
| CVE-2026-76054Invocation of Process Using Visible Sensitive Information in Black Duck blackduck-c-cpp 1.0.17 through 3.0.6 allows an actor able to execute code within the scanned project's buil…Black Duck · blackduck-c-cpp · CVSS 7.1 · 2026-08-24 | 7.1 | 0.2% | 2026-08-24 |
| CVE-2025-32987Arctera eDiscovery Platform before 10.3.2, when Enterprise Vault Collection Module is used, places a cleartext password on a command line in EVSearcher.Arctera · eDiscovery Platform · CVSS 6 · 2025-04-15 | 6.0 | 0.2% | 2025-04-15 |
| CVE-2026-65088NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of process using visible sensitive information. A successful exploit of this vulnerability might…NVIDIA · NemoClaw · CVSS 5.5 · 2026-08-25 | 5.5 | 0.2% | 2026-08-25 |
| CVE-2026-92768Cockpit-machines: cockpit-machines: sensitive data exposure via command-line argumentsRed Hat · Red Hat Enterprise Linux 10 · CVSS 5.5 · 2026-09-18 | 5.5 | 0.2% | 2026-09-18 |
| CVE-2026-92747Cockpit-machines: cockpit-machines: sensitive data exposure of guest credentials via json argument in process listRed Hat · Red Hat Enterprise Linux 10 · CVSS 5 · 2026-09-18 | 5.0 | 0.2% | 2026-09-18 |
| CVE-2026-81684openssl_encrypt before 1.4.9 Information Disclosure via Command Linejahlives · openssl_encrypt · CVSS 6.2 · 2026-08-27 | 6.2 | 0.2% | 2026-08-27 |
| CVE-2026-61670microsandbox: Secret values exposed in world-readable process argumentssuperradcompany · microsandbox · CVSS 6.5 · 2026-09-18 | 6.5 | 0.2% | 2026-09-18 |
| CVE-2026-12139Tanium addressed an information disclosure vulnerability in Connect.Tanium · Connect · CVSS 4.4 · 2026-07-21 | 4.4 | 0.2% | 2026-07-21 |
| CVE-2026-113495Cockpit-machines: cockpit-appstream: rhsm access-token disclosure through image helper command-line argumentsRed Hat · Red Hat Enterprise Linux 10 · CVSS 5 · 2026-10-20 | 5.0 | 0.2% | 2026-10-20 |
| CVE-2026-12250Sensitive Data Exposure in TUBITAK BILGEM's Pardus Domain JoinerTUBITAK BILGEM Software Technologies Research Institute · Pardus Domain Joiner · CVSS 7.9 · 2026-07-05 | 7.9 | 0.2% | 2026-07-05 |
| CVE-2026-109971Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-toolRed Hat · Red Hat Enterprise Linux 10 · CVSS 4.7 · 2026-10-14 | 4.7 | 0.2% | 2026-10-14 |
| CVE-2026-41357OpenClaw < 2026.3.31 - Unsanitized Environment Variable Leakage in SSH Sandbox BackendsOpenClaw · OpenClaw · CVSS 3.3 · 2026-04-23 | 3.3 | 0.2% | 2026-04-23 |
| CVE-2026-80158Ansible-collection-community-general: community.general: ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the ipa bind password in logs and process listingsRed Hat · Red Hat Ceph Storage 5 · CVSS 5.5 · 2026-08-26 | 5.5 | 0.1% | 2026-08-26 |
| CVE-2026-9494ubuntu-pro-client Information Disclosure via Cleartext Bearer Token Exposure in Process Command LineCanonical · ubuntu-pro-client (ubuntu-advantage-tools) · CVSS 5.5 · 2026-07-16 | 5.5 | 0.1% | 2026-07-16 |
| CVE-2026-18915Exposure of OTP Secret Through Process Command-Line Arguments in TÜBİTAK BİLGEM's eta-otp-lockTÜBİTAK BİLGEM Software Technologies Research Institute · eta-otp-lock · CVSS 5 · 2026-08-06 | 5.0 | 0.1% | 2026-08-06 |
| CVE-2026-113496Cockpit-machines: cockpit-appstream: vnc console password disclosure through virt-xml command-line argumentsRed Hat · Red Hat Enterprise Linux 10 · CVSS 5 · 2026-10-20 | 5.0 | 0.1% | 2026-10-20 |
| CVE-2025-53860F5OS-A FIPS HSM vulnerabilityF5 · F5OS - Appliance · CVSS 4.1 · 2025-10-15 | 4.1 | 0.1% | 2025-10-15 |
| CVE-2026-121745nvm exposes NVM_AUTH_HEADER to other local users on the curl/wget command linenvm-sh · nvm · CVSS 2.5 · 2026-11-04 | 2.5 | 0.1% | 2026-11-04 |
| CVE-2026-102371wsl-pro-service: Ubuntu Pro token exposed via process command-line argumentsCanonical · Ubuntu Pro for WSL · CVSS 5.7 · 2026-09-29 | 5.7 | 0.1% | 2026-09-29 |
| CVE-2026-92745Cockpit-machines: cockpit-machines: information disclosure of rhsm offline token via process argumentsRed Hat · Red Hat Enterprise Linux 10 · CVSS 5 · 2026-09-18 | 5.0 | 0.1% | 2026-09-18 |
| CVE-2026-103682Jolokia special agent exposes password in process listCheckmk GmbH · Checkmk · CVSS 2 · 2026-11-06 | 2.0 | 0.1% | 2026-11-06 |
| CVE-2026-103674NetApp ONTAP special agent exposes password in process listCheckmk GmbH · Checkmk · CVSS 2 · 2026-11-06 | 2.0 | 0.1% | 2026-11-06 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.