CVE-2026-92872 | Medium | 4.3 | 2026-09-30 | Pgpool-II inserts sensitive information into log file, which may allow an authenticated attacker to obtain the cluster information. |
CVE-2026-81862 | Medium | 6.5 | 2026-09-29 | Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperator` and `AzureBlobStorageToTeradataOpera… |
CVE-2025-71425 | High | 7.3 | 2026-09-27 | Contrast (Edgeless Systems) before 1.8.1 logs the workload secret to stderr, and thus to Kubernetes logs, when the Contrast initializer is configured with CONT… |
CVE-2025-71423 | High | 7.3 | 2026-09-27 | Edgelesssys Contrast is a confidential-computing runtime for Kubernetes. In versions 1.9.0 before 1.12.2, the initializer logs the full NewMeshCert response —… |
CVE-2026-63208 | | | 2026-09-25 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the a… |
CVE-2026-85417 | | | 2026-09-25 | Incomplete property masking in the SANnav logging subsystem permits SNMP authentication and privacy passwords to be recorded in application logs under specific… |
CVE-2026-82716 | Medium | 4.6 | 2026-09-24 | The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diagnostic logs generated during the suppor… |
CVE-2026-14443 | | | 2026-09-24 | Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written… |
CVE-2026-14442 | | | 2026-09-24 | An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. W… |
CVE-2026-82372 | | | 2026-09-24 | Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being rec… |
CVE-2026-82371 | | | 2026-09-24 | Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve adminis… |
CVE-2026-66068 | | | 2026-09-23 | RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel s… |
CVE-2026-77285 | | | 2026-09-23 | OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template t… |
CVE-2026-95815 | Medium | 6.3 | 2026-09-22 | OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obta… |
CVE-2026-49810 | High | 7.8 | 2026-09-21 | Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged a… |
CVE-2026-93982 | Low | 3.3 | 2026-09-19 | OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction… |
CVE-2026-86049 | High | 7.1 | 2026-09-17 | Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer h… |
CVE-2026-92758 | Medium | 5.5 | 2026-09-17 | If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwo… |
CVE-2026-82723 | | | 2026-09-17 | Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the a… |
CVE-2026-92918 | High | 8.8 | 2026-09-17 | admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission ca… |
CVE-2026-81870 | | | 2026-09-16 | OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal I… |
CVE-2026-73457 | Medium | 5.3 | 2026-09-16 | Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials… |
CVE-2026-73442 | Low | 3.0 | 2026-09-16 | On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an… |
CVE-2026-92237 | Medium | 6.5 | 2026-09-15 | Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authentic… |
CVE-2026-73467 | Medium | 6.3 | 2026-09-15 | On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System… |
CVE-2026-73466 | Medium | 6.3 | 2026-09-15 | On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when speciali… |
CVE-2026-73465 | Medium | 6.3 | 2026-09-15 | On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when s… |
CVE-2026-25826 | Medium | 4.9 | 2026-09-15 | An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accept… |
CVE-2026-81320 | Medium | 5.5 | 2026-09-15 | A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object… |
CVE-2026-84527 | Medium | 5.5 | 2026-09-14 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe… |
CVE-2026-84525 | Medium | 5.5 | 2026-09-14 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be ab… |
CVE-2026-84513 | Medium | 5.5 | 2026-09-14 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macO… |
CVE-2026-55102 | | | 2026-09-14 | hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests throug… |
CVE-2026-82434 | Medium | 6.5 | 2026-09-14 | Description
When ZooKeeper authentication is configured, Storm deliberately retains
`storm.zookeeper.topology.auth.payload` in the topology configuration, bec… |
CVE-2026-87779 | High | 7.5 | 2026-09-14 | Insertion of sensitive information into log file vulnerability in Apache Syncope.
When AES key of non-standard length (not 16/24/32 bytes) is configured, Sy… |
CVE-2026-87993 | High | 7.7 | 2026-09-10 | The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in templat… |
CVE-2026-88883 | High | 7.7 | 2026-09-10 | Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edit… |
CVE-2026-80169 | Low | 3.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information i… |
CVE-2026-79966 | Low | 3.3 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information i… |
CVE-2025-46808 | Medium | 6.8 | 2026-09-09 | An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager container’s log
… |
CVE-2026-80124 | Medium | 5.5 | 2026-09-09 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information i… |
CVE-2026-78631 | Medium | 5.3 | 2026-09-08 | The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion… |
CVE-2026-78627 | High | 7.3 | 2026-09-08 | The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the… |
CVE-2026-68873 | Medium | 5.5 | 2026-09-08 | Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information local… |
CVE-2026-86597 | Medium | 6.5 | 2026-09-08 | Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-re… |
CVE-2026-86501 | Low | 2.8 | 2026-09-07 | In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log |
CVE-2026-80056 | Medium | 5.5 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information i… |
CVE-2026-17442 | Medium | 5.1 | 2026-09-04 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a… |
CVE-2026-16689 | Medium | 6.2 | 2026-09-04 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a… |
CVE-2026-19649 | Medium | 6.2 | 2026-09-04 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a… |
CVE-2026-85174 | High | 8.8 | 2026-09-03 | SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Auth… |
CVE-2026-85171 | Medium | 6.5 | 2026-09-03 | n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decry… |
CVE-2026-55221 | Medium | 6.5 | 2026-09-02 | Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0… |
CVE-2026-55785 | Low | 3.7 | 2026-08-28 | free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in intern… |
CVE-2026-78174 | | | 2026-08-28 | WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retr… |
CVE-2026-81530 | Medium | 5.6 | 2026-08-27 | A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material supplied by the app… |
CVE-2026-59302 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Stream.
Spring Cloud Stream 5.0.0 - 5.0.2
Spring Cloud Stream 4.3.0 - 4.3.3
Spring Cloud Stream 4.2.0 - 4… |
CVE-2026-59301 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Function Azure.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function 4.3.0 - 4.3.4
Spring Cloud Funct… |
CVE-2026-59300 | Low | 3.1 | 2026-08-27 | Potential for logging sensitive data in Spring Cloud Function AWS.
Spring Cloud Function 5.0.0 - 5.0.3
Spring Cloud Function 4.3.0 - 4.3.4
Spring Cloud Functio… |
CVE-2026-81715 | Low | 3.3 | 2026-08-27 | openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-to… |
CVE-2026-81705 | High | 7.5 | 2026-08-27 | openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings (e.g… |
CVE-2026-75573 | Medium | 4.4 | 2026-08-27 | In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and… |
CVE-2026-21808 | Medium | 4.1 | 2026-08-26 | HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an… |
CVE-2026-58070 | | | 2026-08-26 | A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recove… |
CVE-2026-14948 | High | 8.8 | 2026-08-20 | A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext se… |
CVE-2026-14163 | High | 7.5 | 2026-08-20 | In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in… |
CVE-2026-76375 | Medium | 5.0 | 2026-08-19 | In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoki… |
CVE-2026-76374 | Medium | 4.3 | 2026-08-19 | In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory respo… |
CVE-2020-37267 | High | 7.5 | 2026-08-19 | Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git htt… |
CVE-2019-25766 | High | 7.5 | 2026-08-19 | Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The… |
CVE-2026-66780 | Medium | 6.5 | 2026-08-18 | A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive perm… |
CVE-2026-75485 | Medium | 5.5 | 2026-08-18 | A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing… |
CVE-2026-75057 | Medium | 6.2 | 2026-08-17 | In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log |
CVE-2026-59911 | Medium | 5.5 | 2026-08-17 | Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Insertion of Sensitive Information into Log File vulnerability in the svc_tools. A low privileged at… |
CVE-2026-74870 | Low | 3.3 | 2026-08-17 | openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unc… |
CVE-2026-19483 | High | 7.1 | 2026-08-13 | IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin pass… |
CVE-2026-19502 | Medium | 5.5 | 2026-08-12 | MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connectio… |
CVE-2026-18097 | Medium | 5.5 | 2026-08-12 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensi… |
CVE-2026-68969 | Medium | 6.5 | 2026-08-12 | Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH… |
CVE-2026-47234 | Medium | 4.4 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and… |
CVE-2026-18710 | Medium | 6.5 | 2026-08-11 | A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log o… |
CVE-2026-71845 | Medium | 6.3 | 2026-08-11 | A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credent… |
CVE-2026-71474 | High | 7.1 | 2026-08-11 | A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com p… |
CVE-2026-20708 | | | 2026-08-11 | Insertion of sensitive information into log file in the subsystem for the Intel(R) AMT and Intel(R) Standard Manageability may allow an information disclosure… |
CVE-2026-65945 | Medium | 6.5 | 2026-08-10 | Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue. |
CVE-2026-19363 | Medium | 5.3 | 2026-08-09 | A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorize… |
CVE-2026-46358 | | | 2026-08-07 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log… |
CVE-2026-0637 | Medium | 4.4 | 2026-08-06 | When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without suffic… |
CVE-2026-21766 | Medium | 5.4 | 2026-08-05 | The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases… |
CVE-2026-20289 | Medium | 5.7 | 2026-08-05 | A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information.
T… |
CVE-2026-65311 | Medium | 5.3 | 2026-07-31 | The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA)
in affected versions exposes an undocumented endpoint that changes
the server's logging le… |
CVE-2026-12947 | High | 7.5 | 2026-07-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read… |
CVE-2026-44105 | Medium | 6.6 | 2026-07-30 | The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to auth… |
CVE-2026-59326 | Low | 3.3 | 2026-07-30 | The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level whenever it creates… |
CVE-2026-14528 | High | 7.4 | 2026-07-28 | IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information. |
CVE-2026-1918 | Medium | 4.9 | 2026-07-28 | IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6… |
CVE-2026-64800 | Low | 3.5 | 2026-07-23 | In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default |
CVE-2026-65589 | Medium | 6.5 | 2026-07-22 | n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to wor… |
CVE-2026-62211 | Medium | 5.0 | 2026-07-17 | OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to acces… |
CVE-2026-46514 | Medium | 6.5 | 2026-07-16 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext passwor… |