CVE-2026-19483 | High | 7.1 | 2026-08-13 | IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin pass… |
CVE-2026-19502 | Medium | 5.5 | 2026-08-12 | MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connectio… |
CVE-2026-18097 | Medium | 5.5 | 2026-08-12 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensi… |
CVE-2026-68969 | Medium | 6.5 | 2026-08-12 | Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH… |
CVE-2026-47234 | Medium | 4.4 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and… |
CVE-2026-18710 | Medium | 6.5 | 2026-08-11 | A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log o… |
CVE-2026-71845 | Medium | 6.3 | 2026-08-11 | A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credent… |
CVE-2026-71474 | Medium | 6.3 | 2026-08-11 | A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com p… |
CVE-2026-20708 | | | 2026-08-11 | Insertion of sensitive information into log file in the subsystem for the Intel(R) AMT and Intel(R) Standard Manageability may allow an information disclosure… |
CVE-2026-65945 | Medium | 6.5 | 2026-08-10 | Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0
Users are recommended to upgrade to version 2.9.0, which fixes this issue. |
CVE-2026-19363 | Medium | 5.3 | 2026-08-09 | A vulnerability was found in lmammino oidc-authorizer up to 0.4.0. Impacted is an unknown function of the file src/handler.rs of the component Lambda Authorize… |
CVE-2026-46358 | | | 2026-08-07 | OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log… |
CVE-2026-0637 | Medium | 4.4 | 2026-08-06 | When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without suffic… |
CVE-2026-21766 | Medium | 5.4 | 2026-08-05 | The default login portlet in HCL Digital Experience and Digital Experience Compose insufficiently protects credentials. Under certain very specific use cases… |
CVE-2026-20289 | Medium | 5.7 | 2026-08-05 | A vulnerability in the logging subsystem of Cisco RoomOS could allow an authenticated, local attacker with low privileges to access sensitive information.
T… |
CVE-2026-65311 | Medium | 5.3 | 2026-07-31 | The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA)
in affected versions exposes an undocumented endpoint that changes
the server's logging le… |
CVE-2026-12947 | High | 7.5 | 2026-07-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read… |
CVE-2026-44105 | Medium | 6.6 | 2026-07-30 | The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to auth… |
CVE-2026-59326 | Low | 3.3 | 2026-07-30 | The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level whenever it creates… |
CVE-2026-14528 | High | 7.4 | 2026-07-28 | IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information. |
CVE-2026-1918 | Medium | 4.9 | 2026-07-28 | IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6… |
CVE-2026-64800 | Low | 3.5 | 2026-07-23 | In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default |
CVE-2026-65589 | Medium | 6.5 | 2026-07-22 | n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to wor… |
CVE-2026-62211 | Medium | 5.0 | 2026-07-17 | OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to acces… |
CVE-2026-46514 | Medium | 6.5 | 2026-07-16 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext passwor… |
CVE-2026-44969 | Low | 2.5 | 2026-07-16 | dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments… |
CVE-2026-15737 | Medium | 5.7 | 2026-07-16 | AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform.
… |
CVE-2026-40633 | High | 7.8 | 2026-07-15 | Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 through 9.13.0.2 contains an Insertion of Sensitive Information into Log File vulner… |
CVE-2026-50316 | Medium | 5.5 | 2026-07-14 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-22098 | | | 2026-07-13 | Various sensitive information such as passwords and charging card UIDs are written to log files. |
CVE-2026-56459 | Medium | 6.2 | 2026-07-09 | HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure. The application stores potentially sensitive information in log files that… |
CVE-2026-59947 | Medium | 4.7 | 2026-07-08 | Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential… |
CVE-2026-54652 | High | 8.1 | 2026-07-08 | Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer ro… |
CVE-2026-46467 | Medium | 5.8 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-8482 | Medium | 4.3 | 2026-07-02 | A vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.41 (included), 4.8.0 to 4.8.15 (included) , 5.0.0 to 5.0.5 (included)
There is a p… |
CVE-2026-54704 | Medium | 6.5 | 2026-07-01 | OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC au… |
CVE-2026-49088 | Medium | 4.4 | 2026-07-01 | Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (… |
CVE-2026-12086 | Medium | 6.2 | 2026-06-30 | IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8… |
CVE-2026-13750 | Medium | 5.5 | 2026-06-29 | Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug… |
CVE-2026-56457 | Medium | 4.3 | 2026-06-29 | HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information vulnerability in output logs. This exposure could allow an attacker with… |
CVE-2025-59868 | Medium | 5.5 | 2026-06-27 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application inform… |
CVE-2026-9699 | Medium | 6.8 | 2026-06-26 | Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with acces… |
CVE-2026-8330 | Medium | 4.4 | 2026-06-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain co… |
CVE-2026-12053 | High | 8.6 | 2026-06-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have allowed a user to access se… |
CVE-2026-9073 | Medium | 6.2 | 2026-06-23 | A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One… |
CVE-2026-11820 | Medium | 6.5 | 2026-06-23 | A flaw was found in the community.general Ansible collection's nexmo module.
The module constructs HTTP requests to the Vonage/Nexmo SMS API by encoding
API cr… |
CVE-2026-11819 | Medium | 5.5 | 2026-06-23 | Module: plugins/modules/keyring_info.py
CVSS 3.1: 5.5 MEDIUM — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Issue: The module retrieves a passphrase from the OS nat… |
CVE-2026-54236 | Medium | 5.3 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message h… |
CVE-2025-46313 | Medium | 5.5 | 2026-06-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2026-0267 | Medium | 5.5 | 2026-06-10 | An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a local user to learn the configured passcodes for disabling… |
CVE-2026-9751 | Medium | 5.5 | 2026-06-09 | The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text. |
CVE-2026-9735 | Medium | 5.5 | 2026-06-09 | MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is… |
CVE-2026-45581 | Medium | 5.5 | 2026-06-08 | fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is… |
CVE-2026-50205 | High | 8.2 | 2026-06-04 | System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data. |
CVE-2026-45679 | Medium | 6.5 | 2026-06-02 | OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text… |
CVE-2026-40619 | High | 7.8 | 2026-06-02 | A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local OS privileges to t… |
CVE-2026-49200 | Critical | 9.8 | 2026-05-29 | The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for we… |
CVE-2026-45040 | | | 2026-05-28 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive information leakage in log outputs. When the… |
CVE-2026-6720 | | | 2026-05-28 | When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stde… |
CVE-2026-41185 | Medium | 6.5 | 2026-05-28 | When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegati… |
CVE-2026-41184 | Medium | 6.5 | 2026-05-28 | In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOK… |
CVE-2026-32996 | | | 2026-05-28 | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation. |
CVE-2026-5515 | Medium | 5.5 | 2026-05-27 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2026-2607 | Medium | 5.1 | 2026-05-27 | IBM MQ Operator SC2: v3.2.0 through 3.2.23CD: v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.5.3, v3.6.0 - v3.6.4, v3.7.0 - v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9… |
CVE-2025-13755 | Medium | 5.5 | 2026-05-26 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes DB2 Connect Server) stores potentially sensitive information in… |
CVE-2026-25193 | High | 8.1 | 2026-05-25 | Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.
Mitig… |
CVE-2021-21508 | Medium | 6.7 | 2026-05-22 | Dell VxRail versions before 7.0.200 contain a Plain-text Password Storage Vulnerability in VxRail Manager. A sys-admin user may exploit this vulnerability, lea… |
CVE-2026-8671 | High | 7.5 | 2026-05-22 | Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows Resource Leak Exposure.
This issue affe… |
CVE-2026-44052 | High | 7.5 | 2026-05-21 | Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain L… |
CVE-2026-20239 | High | 7.5 | 2026-05-20 | In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a us… |
CVE-2026-44516 | High | 7.6 | 2026-05-14 | Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatic… |
CVE-2026-44479 | Medium | 5.5 | 2026-05-13 | Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode (--non-inter… |
CVE-2026-41219 | Medium | 6.5 | 2026-05-13 | An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView fi… |
CVE-2026-8200 | Low | 2.7 | 2026-05-13 | When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not… |
CVE-2026-43992 | Critical | 9.8 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract… |
CVE-2026-28987 | High | 7.5 | 2026-05-11 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7… |
CVE-2026-28943 | High | 7.5 | 2026-05-11 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7… |
CVE-2026-28923 | High | 8.8 | 2026-05-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious app… |
CVE-2026-43826 | Medium | 6.5 | 2026-05-11 | The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote… |
CVE-2026-41018 | Medium | 6.5 | 2026-05-11 | The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wr… |
CVE-2026-42282 | Medium | 4.3 | 2026-05-08 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.13, when n8n-mcp runs… |
CVE-2026-41495 | Medium | 5.3 | 2026-05-08 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.11, when n8n-mcp runs… |
CVE-2026-41004 | Medium | 4.4 | 2026-05-07 | When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs.
Spring Cloud Config 3.1.x: affected from… |
CVE-2024-30151 | High | 8.3 | 2026-05-06 | HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users t… |
CVE-2026-7824 | | | 2026-05-05 | An issue was discovered in the PaperCut Hive Ricoh embedded application. When the "Deep Logging" (diagnostic) mode is enabled, the application inadvertently re… |
CVE-2025-67223 | High | 7.5 | 2026-04-28 | The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly acc… |
CVE-2026-41182 | Medium | 5.3 | 2026-04-23 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python… |
CVE-2026-40945 | | | 2026-04-21 | Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext… |
CVE-2026-23775 | High | 7.6 | 2026-04-17 | Dell PowerProtect Data Domain appliances with Data Domain Operating System (DD OS) of Feature Release versions 8.0 through 8.5, LTS2025 release version 8.3.1.0… |
CVE-2026-34164 | Medium | 4.9 | 2026-04-16 | Valtimo is an open-source business process automation platform. In versions 13.0.0 through 13.21.0, the InboxHandlingService logs the full content of every inc… |
CVE-2025-43937 | Medium | 6.6 | 2026-04-16 | Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an insertion of sensitive information into log file vulnerability. A low privileged attacker with l… |
CVE-2026-31987 | High | 7.5 | 2026-04-16 | JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors.
Users are advised to upgrade to Airflow version that contains… |
CVE-2026-20205 | High | 7.2 | 2026-04-15 | In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk `_internal` index or possesses the high-privilege capability… |
CVE-2026-40091 | Medium | 6.0 | 2026-04-15 | SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB… |
CVE-2026-32218 | Medium | 5.5 | 2026-04-14 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-32217 | Medium | 5.5 | 2026-04-14 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-32215 | Medium | 5.5 | 2026-04-14 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-0207 | | | 2026-04-14 | A vulnerability exists in FlashBlade whereby sensitive information may be logged under specific conditions. |
CVE-2026-2401 | Medium | 5.0 | 2026-04-14 | CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user ex… |
CVE-2025-66236 | High | 7.5 | 2026-04-13 | Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security d… |