CWE-532 · Insertion of Sensitive Information into Log File (page 2)
Page 2 of 12 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34487 | High | 7.5 | 2026-04-09 | Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer… |
CVE-2026-4901 | Medium | 6.5 | 2026-04-09 | AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further authorized access in… |
CVE-2026-28261 | High | 7.8 | 2026-04-08 | Dell Elastic Cloud Storage, version 3.8.1.7 and prior, and Dell ObjectScale, versions prior to 4.1.0.3 and version 4.2.0.0, contains an Insertion of Sensitive… |
CVE-2026-4788 | High | 8.4 | 2026-04-08 | IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.37 stores sensitive information in log files that could be read by a local user. |
CVE-2026-27315 | Medium | 5.5 | 2026-04-07 | Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via… |
CVE-2026-35185 | High | 7.5 | 2026-04-06 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive… |
CVE-2019-25683 | Medium | 6.2 | 2026-04-05 | FileZilla 3.40.0 contains a denial of service vulnerability in the local search functionality that allows local attackers to crash the application by supplying… |
CVE-2026-4819 | Medium | 4.9 | 2026-03-31 | In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana. |
CVE-2026-32982 | High | 7.5 | 2026-03-31 | OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages… |
CVE-2026-4957 | Low | 2.7 | 2026-03-27 | A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle_tool_call of the file XAgent/function_handler.py of… |
CVE-2024-11604 | | 2026-03-27 | Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows… | |
CVE-2025-36187 | Medium | 4.4 | 2026-03-25 | IBM Knowledge Catalog Standard Cartridge 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1 stores potentially sensitive information in log fil… |
CVE-2026-28868 | Medium | 5.5 | 2026-03-25 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5… |
CVE-2026-20668 | Medium | 5.5 | 2026-03-25 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5… |
CVE-2026-32598 | Medium | 6.5 | 2026-03-13 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containin… |
CVE-2026-0520 | Low | 2.8 | 2026-03-11 | A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authenticated user to retrie… |
CVE-2026-20165 | Medium | 6.3 | 2026-03-11 | In Splunk Enterprise versions below 10.2.1, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.7, 10.1.2507.17, 10.0.2503.12, and 9… |
CVE-2026-21791 | Low | 3.3 | 2026-03-10 | HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL |
CVE-2025-70040 | Medium | 5.3 | 2026-03-09 | An issue pertaining to CWE-532: Insertion of Sensitive Information into Log File was discovered in LupinLin1 jimeng-web-mcp v2.1.2. This allows an attacker to… |
CVE-2026-29184 | Low | 2.0 | 2026-03-07 | Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism t… |
CVE-2026-24308 | High | 7.5 | 2026-03-07 | Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information s… |
CVE-2026-21786 | Low | 3.3 | 2026-03-05 | HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs. |
CVE-2025-62879 | Medium | 6.8 | 2026-03-04 | A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-b… |
CVE-2026-1265 | Medium | 4.3 | 2026-03-03 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to writing of sensitive Information in a log file. |
CVE-2025-48635 | High | 7.7 | 2026-03-02 | In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This could lead to loc… |
CVE-2026-27900 | Medium | 5.0 | 2026-02-26 | The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackScript content, and object storage data… |
CVE-2025-0976 | Medium | 4.7 | 2026-02-25 | Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager.This issue affects Hitachi Ops Center API Con… |
CVE-2025-5781 | Medium | 5.2 | 2026-02-25 | Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager, Hitachi Device Manager allows Session Hijack… |
CVE-2025-27555 | Medium | 6.5 | 2026-02-24 | Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they shou… |
CVE-2026-2605 | Medium | 5.3 | 2026-02-20 | Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS. |
CVE-2026-2350 | Medium | 6.5 | 2026-02-20 | Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS. |
CVE-2026-1292 | Medium | 6.5 | 2026-02-20 | Tanium addressed an insertion of sensitive information into log file vulnerability in Trends. |
CVE-2026-20144 | Medium | 6.8 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11, and Splunk Cloud Platform versions below 10.2.2510.0, 10.1.2507.11, 10.0.2503.9… |
CVE-2026-20142 | Medium | 6.8 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with acc… |
CVE-2026-20138 | Medium | 6.8 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with acc… |
CVE-2026-20663 | Low | 3.3 | 2026-02-11 | The issue was resolved by sanitizing logging. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An app may be able to enumerate a… |
CVE-2026-20646 | Low | 3.3 | 2026-02-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.3. A malicious app may be able to read sensitive location inf… |
CVE-2026-1495 | Medium | 6.5 | 2026-02-10 | The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including URL and proxy crede… |
CVE-2026-21222 | Medium | 5.5 | 2026-02-10 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-11547 | High | 7.8 | 2026-02-10 | AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user. |
CVE-2026-25918 | Medium | 5.5 | 2026-02-09 | unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive cr… |
CVE-2026-25813 | High | 7.5 | 2026-02-09 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to consol… |
CVE-2026-25846 | Medium | 6.5 | 2026-02-09 | In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs |
CVE-2025-15332 | Medium | 4.9 | 2026-02-05 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2026-22038 | High | 8.1 | 2026-02-04 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autog… |
CVE-2026-1622 | | 2026-02-04 | Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a potential information disclosure by a user who has ability… | |
CVE-2026-24762 | High | 7.5 | 2026-02-03 | RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material (access key, secret… |
CVE-2026-22778 | Critical | 9.8 | 2026-02-02 | vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpo… |
CVE-2026-25211 | Low | 3.2 | 2026-01-30 | Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log. |
CVE-2026-0936 | Medium | 5.0 | 2026-01-29 | An Insertion of Sensitive Information into Log File vulnerability in B&R PVI client versions prior to 6.5 may be abused by an authenticated local attacker to g… |
CVE-2025-13925 | Medium | 4.9 | 2026-01-20 | IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged user. |
CVE-2025-59355 | Medium | 6.5 | 2026-01-19 | A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records the complete input parameter string in t… |
CVE-2026-0519 | Low | 3.4 | 2026-01-17 | In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations. Any party… |
CVE-2025-43508 | Medium | 5.5 | 2026-01-16 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2026-22782 | High | 7.5 | 2026-01-16 | RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared… |
CVE-2025-68675 | High | 7.5 | 2026-01-16 | In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication… |
CVE-2026-23493 | High | 8.6 | 2026-01-15 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variable… |
CVE-2026-20818 | Medium | 6.2 | 2026-01-13 | Insertion of sensitive information into log file in Windows Kernel allows an unauthorized attacker to disclose information locally. |
CVE-2026-22798 | Medium | 5.9 | 2026-01-12 | hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take a… |
CVE-2025-68919 | Medium | 5.6 | 2025-12-24 | Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12, when collected maintenance data is accessibl… |
CVE-2025-66910 | Medium | 6.0 | 2025-12-19 | Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService… |
CVE-2025-14437 | High | 7.5 | 2025-12-18 | The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request'… |
CVE-2025-46277 | Low | 3.3 | 2025-12-17 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, watchOS 26.2. An app may be able… |
CVE-2025-43475 | Medium | 5.5 | 2025-12-17 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2. An app may be able to access user-sensitive data. |
CVE-2025-13321 | Low | 3.3 | 2025-12-17 | Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker w… |
CVE-2025-14432 | Medium | 4.9 | 2025-12-16 | In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes… |
CVE-2025-43517 | Low | 3.3 | 2025-12-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tah… |
CVE-2025-13743 | High | 7.5 | 2025-12-09 | Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization. This poses a risk of leaking sensiti… |
CVE-2024-47570 | Medium | 6.6 | 2025-12-09 | An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7… |
CVE-2025-64650 | Medium | 6.5 | 2025-12-08 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files. |
CVE-2020-36876 | | 2025-12-05 | ReQuest Serious Play F3 Media Server versions 7.0.3.4968 (Pro), 7.0.2.4954, 6.5.2.4954, 6.4.2.4681, 6.3.2.4203, and 2.0.1.823 allows unauthenticated attackers… | |
CVE-2025-12996 | Medium | 4.1 | 2025-12-04 | Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under cert… |
CVE-2025-14010 | Medium | 5.5 | 2025-12-04 | A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaint… |
CVE-2025-66411 | High | 7.8 | 2025-12-03 | Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containin… |
CVE-2025-13611 | Low | 2.0 | 2025-11-26 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 that could have allowed an authenticated u… |
CVE-2025-20373 | Low | 2.7 | 2025-11-26 | In Splunk Add-on for Palo Alto Networks versions below 2.0.2, the add-on exposes client secrets in plain text in the _internal index during the addition of new… |
CVE-2025-63729 | Critical | 9.0 | 2025-11-25 | An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SSL Certific… |
CVE-2025-11446 | Medium | 6.5 | 2025-11-19 | Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects… |
CVE-2025-54971 | Medium | 4.3 | 2025-11-18 | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, F… |
CVE-2025-62209 | Medium | 5.5 | 2025-11-11 | Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. |
CVE-2025-62208 | Medium | 5.5 | 2025-11-11 | Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. |
CVE-2025-12940 | Medium | 5.5 | 2025-11-11 | Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Man… |
CVE-2025-11008 | Critical | 9.8 | 2025-11-04 | The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.1 via the log file. This makes it… |
CVE-2025-43426 | Medium | 5.5 | 2025-11-04 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1. An app may be able to access sen… |
CVE-2025-43423 | Low | 2.0 | 2025-11-04 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2… |
CVE-2025-40603 | Medium | 4.5 | 2025-10-31 | A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administrator, under certain… |
CVE-2025-62232 | High | 7.5 | 2025-10-31 | Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is… |
CVE-2025-58189 | Medium | 5.3 | 2025-10-29 | When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escap… |
CVE-2024-58269 | Medium | 4.3 | 2025-10-29 | A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is… |
CVE-2025-62262 | Medium | 4.4 | 2025-10-27 | Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Lifera… |
CVE-2025-11248 | Low | 3.2 | 2025-10-27 | ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with acces… |
CVE-2025-11504 | High | 7.5 | 2025-10-24 | The Quickcreator – AI Blog Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 0.0.9 to 0.1.17 through the /wp-content/plug… |
CVE-2025-62705 | Medium | 4.9 | 2025-10-22 | OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when releva… |
CVE-2025-62513 | High | 7.5 | 2025-10-22 | OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP b… |
CVE-2025-46752 | Medium | 4.4 | 2025-10-16 | A insertion of sensitive information into log file in Fortinet FortiDLP 12.0.0 through 12.0.5, 11.5.1, 11.4.6, 11.4.5 allows attacker to information disclosure… |
CVE-2025-20329 | Medium | 4.9 | 2025-10-15 | A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenticated, remote attac… |
CVE-2025-10486 | Medium | 5.3 | 2025-10-15 | The Content Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.8 through publicly exposed lo… |
CVE-2025-59258 | Medium | 6.2 | 2025-10-14 | Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally. |
CVE-2025-59203 | Medium | 5.5 | 2025-10-14 | Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locally. |
CVE-2025-59197 | Medium | 5.5 | 2025-10-14 | Insertion of sensitive information into log file in Windows ETL Channel allows an authorized attacker to disclose information locally. |