CVE-2025-14376
NoneCVSS
—
EPSS
0.1%
Published
Jan 20, 2026
CISA due date
—
The record
A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext secrets stored in environment variables on the ADI server. This component has been retired and has been optional since the 1.36 release in 2024.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-87951 Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service… CWE-922
- CVE-2026-44629 Improper access control to the Synergis Softwire installation folder. CWE-922
- CVE-2026-20705 Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R)… CWE-922
- CVE-2026-47362 In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed… CWE-922
- CVE-2026-46511 HAX CMS helps manage microsite universe with PHP or NodeJs backends. CWE-922
- CVE-2026-5515 IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores potentially sensitive… CWE-922
- GHSA-x3x5-7h4h-gwxg HAXcms: Mass Token Exfiltration and Cross-Tenant Hijack CWE-922
- CVE-2026-7257 ** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information… CWE-922