It can be.
Generally speaking, programs while running don't tend to wipe out their data (they do, after all, tend to need it), and any process with the ability to access other programs' allocated RAM can, in fact, read it. This is how, for example, the recent spate of big box store hacks were able to leak so much credit card data -- the attacks were carried about by rogue programs that scoured the running POS machine's RAM and copied anything that looked like card data. [I can't at the moment find a source to back this one up, I'll keep looking and edit it in later.]
Once a program terminates, the data that was in its RAM may remain around indefinitely if no other process gets allocated those same addresses and overwrites it with its own data. On modern operating systems this again requires the ability to read RAM not allocated to the process doing the reading1, and even then is unreliable at best, especially on modern systems that are constantly doing all kinds of things.
Both of these can be mitigated, if not outright prevented, by never allowing untrusted processes to run with root/administrator privileges: limited users simply do not have the ability, barring holes in the OS's security model, to access this RAM.
And, of course, there's our good friend the "cold boot attack", where encryption keys etc. are read from RAM after the machine has been powered down. This requires physical access to the machine, a boot disk (or specialized hardware), and quick timing (as data remains resident in RAM for only a short time after it's powered down).
As a quick footnote, the risks of data remanence on hard drives are rather overblown: Once data's been overwritten, it's gone. The "Gutmann 35-pass method", for example, is not only a fundamental misunderstanding of Dr. Gutmann's research, but wholly unnecessary -- a single pass with any data -- ones, zeros, random noise, kitty pictures -- is all that's really necessary. If it's not overwritten, however -- if it's merely deleted -- then it does hang around, though. Data remanence on RAM is similarly an often-overstated risk, though just like hard drives it can and does leak information if you're not careful.
1 The reason is that modern operating systems actually take the time to wipe out RAM before allocating it to a new process, specifically to avoid leaking potentially sensitive data to processes that start up and then read uninitialized data (which in the past is how such leaks were carried out).
