CWE-226
Sensitive Information in Resource Not Removed Before Reuse
The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or zeroize the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
Impactr finds and proves whether CWE-226 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.