CVE-2026-85961 | High | 7.5 | 2026-10-12 | On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication inform… |
CVE-2026-85949 | High | 8.1 | 2026-10-12 | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certai… |
CVE-2026-108858 | Medium | 5.5 | 2026-10-11 | Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes the caller-supplied api_token from POST /generate request bo… |
CVE-2026-108857 | Low | 3.3 | 2026-10-11 | Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args s… |
CVE-2026-108754 | Low | 3.3 | 2026-10-11 | GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query strin… |
CVE-2026-107783 | Medium | 5.9 | 2026-10-09 | Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's cleartext AWS Mana… |
CVE-2026-87980 | Low | 3.1 | 2026-10-08 | IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a local attacker to obtain sensitive information due to cleartext storage of sensitive informatio… |
CVE-2026-107293 | | | 2026-10-08 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrume… |
CVE-2026-107291 | | | 2026-10-08 | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.6 and 2.44.0, OpenTelemetry instrume… |
CVE-2026-87672 | | | 2026-10-08 | An information disclosure vulnerability exists in the SupportLink diagnostic collection utilities of Brocade Fabric OS versions before 10.0.1. When SupportLink… |
CVE-2026-103371 | High | 7.5 | 2026-10-07 | Insertion of Sensitive Information into Log File in Apache Geode Web Management.
This issue affects Apache Geode: from 2.0.0 before 2.0.3.
Users are reco… |
CVE-2026-16528 | | | 2026-10-07 | Insertion of Sensitive Information into Log File in certain ASUS router models allows a remote authenticated attacker to obtain DDNS credentials from the syste… |
CVE-2026-106504 | Medium | 6.5 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive inform… |
CVE-2026-106502 | Medium | 5.3 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive informat… |
CVE-2026-106499 | Medium | 4.9 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived val… |
CVE-2026-63689 | Medium | 6.5 | 2026-10-06 | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attack… |
CVE-2026-61411 | High | 7.7 | 2026-10-06 | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attack… |
CVE-2026-94594 | Medium | 4.0 | 2026-10-02 | Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access… |
CVE-2026-94593 | High | 7.8 | 2026-10-02 | Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the ho… |
CVE-2026-104055 | | | 2026-10-02 | The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database conne… |
CVE-2026-104872 | Medium | 5.8 | 2026-10-02 | OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentel… |
CVE-2026-78242 | | | 2026-10-01 | Insertion of sensitive information into log file vulnerability in Apache APISIX.
This vulnerability can cause the unmasked header value to be written to the… |
CVE-2026-92872 | Medium | 4.3 | 2026-09-30 | Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information. |
CVE-2026-81862 | Medium | 6.5 | 2026-09-29 | Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperator` and `AzureBlobStorageToTeradataOpera… |
CVE-2025-71425 | High | 7.3 | 2026-09-27 | Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONT… |
CVE-2025-71423 | High | 7.3 | 2026-09-27 | Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response —… |
CVE-2026-63208 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the a… |
CVE-2026-85417 | | | 2026-09-25 | Incomplete property masking in the SANnav logging subsystem permits SNMP authentication and privacy passwords to be recorded in application logs under specific… |
CVE-2026-82716 | Medium | 4.6 | 2026-09-24 | The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diagnostic logs generated during the suppor… |
CVE-2026-14443 | | | 2026-09-24 | Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written… |
CVE-2026-14442 | | | 2026-09-24 | An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. W… |
CVE-2026-82372 | | | 2026-09-24 | Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being rec… |
CVE-2026-82371 | | | 2026-09-24 | Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve adminis… |
CVE-2026-66068 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel s… |
CVE-2026-77285 | | | 2026-09-23 | OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template t… |
CVE-2026-95815 | Medium | 6.3 | 2026-09-22 | OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obta… |
CVE-2026-49810 | High | 7.8 | 2026-09-21 | Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged a… |
CVE-2026-93982 | Low | 3.3 | 2026-09-19 | OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attacker… |
CVE-2026-86049 | High | 7.1 | 2026-09-17 | Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer h… |
CVE-2026-92758 | Medium | 5.5 | 2026-09-17 | If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwo… |
CVE-2026-82723 | | | 2026-09-17 | Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the a… |
CVE-2026-92918 | High | 8.8 | 2026-09-17 | admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission ca… |
CVE-2026-81870 | | | 2026-09-16 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal I… |
CVE-2026-73457 | Medium | 5.3 | 2026-09-16 | Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials… |
CVE-2026-73442 | Low | 3.0 | 2026-09-16 | On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an… |
CVE-2026-92237 | Medium | 6.5 | 2026-09-15 | Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authentic… |
CVE-2026-73467 | Medium | 6.3 | 2026-09-15 | On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System… |
CVE-2026-73466 | Medium | 6.3 | 2026-09-15 | On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when speciali… |
CVE-2026-73465 | Medium | 6.3 | 2026-09-15 | On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when s… |
CVE-2026-25826 | Medium | 4.9 | 2026-09-15 | An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accept… |
CVE-2026-81320 | Medium | 5.5 | 2026-09-15 | A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object… |
CVE-2026-84527 | Medium | 5.5 | 2026-09-14 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe… |
CVE-2026-84525 | Medium | 5.5 | 2026-09-14 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be ab… |
CVE-2026-84513 | Medium | 5.5 | 2026-09-14 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macO… |
CVE-2026-55102 | | | 2026-09-14 | hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests throug… |
CVE-2026-82434 | Medium | 6.5 | 2026-09-14 | Description
When ZooKeeper authentication is configured, Storm deliberately retains
`storm.zookeeper.topology.auth.payload` in the topology configuration, bec… |
CVE-2026-87779 | High | 7.5 | 2026-09-14 | Insertion of sensitive information into log file vulnerability in Apache Syncope.
When AES key of non-standard length (not 16/24/32 bytes) is configured, Sy… |
CVE-2026-87993 | High | 7.7 | 2026-09-10 | The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in templat… |
CVE-2026-88883 | High | 7.7 | 2026-09-10 | Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edit… |
CVE-2026-80169 | Low | 3.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information i… |
CVE-2026-79966 | Low | 3.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information i… |
CVE-2025-46808 | Medium | 6.8 | 2026-09-09 | An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager container’s log
… |
CVE-2026-80124 | Medium | 5.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information i… |
CVE-2026-78631 | Medium | 5.3 | 2026-09-08 | The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion… |
CVE-2026-78627 | High | 7.3 | 2026-09-08 | The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the… |
CVE-2026-68873 | Medium | 5.5 | 2026-09-08 | Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information local… |
CVE-2026-86597 | Medium | 6.5 | 2026-09-08 | Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-re… |
CVE-2026-86501 | Low | 2.8 | 2026-09-07 | In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log |
CVE-2026-80056 | Medium | 5.5 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information i… |
CVE-2026-17442 | Medium | 5.1 | 2026-09-04 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a… |
CVE-2026-16689 | Medium | 6.2 | 2026-09-04 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a… |
CVE-2026-19649 | Medium | 6.2 | 2026-09-04 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a… |
CVE-2026-85174 | High | 8.8 | 2026-09-03 | SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Auth… |
CVE-2026-85171 | Medium | 6.5 | 2026-09-03 | n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decry… |
CVE-2026-55221 | Medium | 6.5 | 2026-09-02 | Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0… |
CVE-2026-55785 | Low | 3.7 | 2026-08-28 | free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in intern… |
CVE-2026-78174 | | | 2026-08-28 | WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retr… |
CVE-2026-81530 | Medium | 5.6 | 2026-08-27 | A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the app… |
CVE-2026-59302 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Stream.
Spring Cloud Stream 5.0.0 - 5.0.2
Spring Cloud Stream 4.3.0 - 4.3.3
Spring Cloud Stream 4.2.0 - 4… |
CVE-2026-59301 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Function Azure.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function 4.3.0 - 4.3.4
Spring Cloud Funct… |
CVE-2026-59300 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Function AWS.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function 4.3.0 - 4.3.4
Spring Cloud Functio… |
CVE-2026-81715 | Low | 3.3 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-to… |
CVE-2026-81705 | High | 7.5 | 2026-08-27 | openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g… |
CVE-2026-75573 | Medium | 4.4 | 2026-08-27 | In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and… |
CVE-2026-21808 | Medium | 4.1 | 2026-08-26 | HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an… |
CVE-2026-58070 | | | 2026-08-26 | A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recove… |
CVE-2026-14948 | High | 8.8 | 2026-08-20 | A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext se… |
CVE-2026-14163 | High | 7.5 | 2026-08-20 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in… |
CVE-2026-76375 | Medium | 5.0 | 2026-08-19 | In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoki… |
CVE-2026-76374 | Medium | 4.3 | 2026-08-19 | In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory respo… |
CVE-2020-37267 | High | 7.5 | 2026-08-19 | Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git htt… |
CVE-2019-25766 | High | 7.5 | 2026-08-19 | Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The… |
CVE-2026-66780 | Medium | 6.5 | 2026-08-18 | A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive perm… |
CVE-2026-75485 | Medium | 5.5 | 2026-08-18 | A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing… |
CVE-2026-75057 | Medium | 6.2 | 2026-08-17 | In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log |
CVE-2026-59911 | Medium | 5.5 | 2026-08-17 | Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Insertion of Sensitive Information into Log File vulnerability in the svc_tools. A low privileged at… |
CVE-2026-74870 | Low | 3.3 | 2026-08-17 | openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unc… |
CVE-2026-19483 | High | 7.1 | 2026-08-13 | IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin pass… |
CVE-2026-19502 | Medium | 5.5 | 2026-08-12 | MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connectio… |
CVE-2026-18097 | Medium | 5.5 | 2026-08-12 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensi… |