CWE-532 · Insertion of Sensitive Information into Log File (page 2)
Page 2 of 13 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-44969 | Low | 2.5 | 2026-07-16 | dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments… |
CVE-2026-15737 | Medium | 5.7 | 2026-07-16 | AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. … |
CVE-2026-40633 | High | 7.8 | 2026-07-15 | Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 through 9.13.0.2 contains an Insertion of Sensitive Information into Log File vulner… |
CVE-2026-50316 | Medium | 5.5 | 2026-07-14 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-22098 | | 2026-07-13 | Various sensitive information such as passwords and charging card UIDs are written to log files. | |
CVE-2026-56459 | Medium | 6.2 | 2026-07-09 | HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure. The application stores potentially sensitive information in log files that… |
CVE-2026-59947 | Medium | 4.7 | 2026-07-08 | Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential… |
CVE-2026-54652 | High | 8.1 | 2026-07-08 | Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer ro… |
CVE-2026-46467 | Medium | 5.8 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30… |
CVE-2026-8482 | Medium | 4.3 | 2026-07-02 | A vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.41 (included), 4.8.0 to 4.8.15 (included) , 5.0.0 to 5.0.5 (included) There is a p… |
CVE-2026-54704 | Medium | 6.5 | 2026-07-01 | OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC au… |
CVE-2026-49088 | Medium | 4.4 | 2026-07-01 | Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (… |
CVE-2026-12086 | Medium | 6.2 | 2026-06-30 | IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8… |
CVE-2026-13750 | Medium | 5.5 | 2026-06-29 | Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug… |
CVE-2026-56457 | Medium | 4.3 | 2026-06-29 | HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information vulnerability in output logs. This exposure could allow an attacker with… |
CVE-2025-59868 | Medium | 5.5 | 2026-06-27 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application inform… |
CVE-2026-9699 | Medium | 6.8 | 2026-06-26 | Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with acces… |
CVE-2026-8330 | Medium | 4.4 | 2026-06-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.3 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain co… |
CVE-2026-12053 | High | 8.6 | 2026-06-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have allowed a user to access se… |
CVE-2026-9073 | Medium | 6.2 | 2026-06-23 | A flaw was found in foreman-mcp-server. This component utilizes two distinct logging mechanisms that can expose sensitive session and authentication data. One… |
CVE-2026-11820 | Medium | 6.5 | 2026-06-23 | A flaw was found in the community.general Ansible collection's nexmo module. The module constructs HTTP requests to the Vonage/Nexmo SMS API by encoding API cr… |
CVE-2026-11819 | Medium | 5.5 | 2026-06-23 | Module: plugins/modules/keyring_info.py CVSS 3.1: 5.5 MEDIUM — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Issue: The module retrieves a passphrase from the OS nat… |
CVE-2026-54236 | Medium | 5.3 | 2026-06-22 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message h… |
CVE-2025-46313 | Medium | 5.5 | 2026-06-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2026-0267 | Medium | 5.5 | 2026-06-10 | An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a local user to learn the configured passcodes for disabling… |
CVE-2026-9751 | Medium | 5.5 | 2026-06-09 | The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text. |
CVE-2026-9735 | Medium | 5.5 | 2026-06-09 | MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is… |
CVE-2026-45581 | Medium | 5.5 | 2026-06-08 | fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is… |
CVE-2026-50205 | High | 8.2 | 2026-06-04 | System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data. |
CVE-2026-45679 | Medium | 6.5 | 2026-06-02 | OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text… |
CVE-2026-40619 | High | 7.8 | 2026-06-02 | A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local OS privileges to t… |
CVE-2026-49200 | Critical | 9.8 | 2026-05-29 | The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for we… |
CVE-2026-45040 | | 2026-05-28 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive information leakage in log outputs. When the… | |
CVE-2026-6720 | | 2026-05-28 | When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stde… | |
CVE-2026-41185 | Medium | 6.5 | 2026-05-28 | When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegati… |
CVE-2026-41184 | Medium | 6.5 | 2026-05-28 | In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOK… |
CVE-2026-32996 | | 2026-05-28 | This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation. | |
CVE-2026-5515 | Medium | 5.5 | 2026-05-27 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2026-2607 | Medium | 5.1 | 2026-05-27 | IBM MQ Operator SC2: v3.2.0 through 3.2.23CD: v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.5.3, v3.6.0 - v3.6.4, v3.7.0 - v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9… |
CVE-2025-13755 | Medium | 5.5 | 2026-05-26 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes DB2 Connect Server) stores potentially sensitive information in… |
CVE-2026-25193 | High | 8.1 | 2026-05-25 | Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure. Mitig… |
CVE-2021-21508 | Medium | 6.7 | 2026-05-22 | Dell VxRail versions before 7.0.200 contain a Plain-text Password Storage Vulnerability in VxRail Manager. A sys-admin user may exploit this vulnerability, lea… |
CVE-2026-8671 | High | 7.5 | 2026-05-22 | Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows Resource Leak Exposure. This issue affe… |
CVE-2026-44052 | High | 7.5 | 2026-05-21 | Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain L… |
CVE-2026-20239 | High | 7.5 | 2026-05-20 | In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a us… |
CVE-2026-44516 | High | 7.6 | 2026-05-14 | Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatic… |
CVE-2026-44479 | Medium | 5.5 | 2026-05-13 | Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode (--non-inter… |
CVE-2026-41219 | Medium | 6.5 | 2026-05-13 | An improper sanitization vulnerability exists in the BIG-IP QKView utility that allows a low-privileged attacker to read sensitive information from a QKView fi… |
CVE-2026-8200 | Low | 2.7 | 2026-05-13 | When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not… |
CVE-2026-43992 | Critical | 9.8 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens, execute_contract, instantiate_contract… |
CVE-2026-28987 | High | 7.5 | 2026-05-11 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7… |
CVE-2026-28943 | High | 7.5 | 2026-05-11 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7… |
CVE-2026-28923 | High | 8.8 | 2026-05-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious app… |
CVE-2026-43826 | Medium | 6.5 | 2026-05-11 | The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote… |
CVE-2026-41018 | Medium | 6.5 | 2026-05-11 | The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wr… |
CVE-2026-42282 | Medium | 4.3 | 2026-05-08 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.13, when n8n-mcp runs… |
CVE-2026-41495 | Medium | 5.3 | 2026-05-08 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to version 2.47.11, when n8n-mcp runs… |
CVE-2026-41004 | Medium | 4.4 | 2026-05-07 | When enabling trace logging in Spring Cloud Config Server sensitive information was placed in plain text in the logs. Spring Cloud Config 3.1.x: affected from… |
CVE-2024-30151 | High | 8.3 | 2026-05-06 | HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users t… |
CVE-2026-7824 | | 2026-05-05 | An issue was discovered in the PaperCut Hive Ricoh embedded application. When the "Deep Logging" (diagnostic) mode is enabled, the application inadvertently re… | |
CVE-2025-67223 | High | 7.5 | 2026-04-28 | The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable names in a publicly acc… |
CVE-2026-41182 | Medium | 5.3 | 2026-04-23 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python… |
CVE-2026-40945 | | 2026-04-21 | Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext… | |
CVE-2026-23775 | High | 7.6 | 2026-04-17 | Dell PowerProtect Data Domain appliances with Data Domain Operating System (DD OS) of Feature Release versions 8.0 through 8.5, LTS2025 release version 8.3.1.0… |
CVE-2026-34164 | Medium | 4.9 | 2026-04-16 | Valtimo is an open-source business process automation platform. In versions 13.0.0 through 13.21.0, the InboxHandlingService logs the full content of every inc… |
CVE-2025-43937 | Medium | 6.6 | 2026-04-16 | Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an insertion of sensitive information into log file vulnerability. A low privileged attacker with l… |
CVE-2026-31987 | High | 7.5 | 2026-04-16 | JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains… |
CVE-2026-20205 | High | 7.2 | 2026-04-15 | In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk `_internal` index or possesses the high-privilege capability… |
CVE-2026-40091 | Medium | 6.0 | 2026-04-15 | SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB… |
CVE-2026-32218 | Medium | 5.5 | 2026-04-14 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-32217 | Medium | 5.5 | 2026-04-14 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-32215 | Medium | 5.5 | 2026-04-14 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-0207 | | 2026-04-14 | A vulnerability exists in FlashBlade whereby sensitive information may be logged under specific conditions. | |
CVE-2026-2401 | Medium | 5.0 | 2026-04-14 | CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user ex… |
CVE-2025-66236 | High | 7.5 | 2026-04-13 | Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security d… |
CVE-2026-34487 | High | 7.5 | 2026-04-09 | Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer… |
CVE-2026-4901 | Medium | 6.5 | 2026-04-09 | AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further authorized access in… |
CVE-2026-28261 | High | 7.8 | 2026-04-08 | Dell Elastic Cloud Storage, version 3.8.1.7 and prior, and Dell ObjectScale, versions prior to 4.1.0.3 and version 4.2.0.0, contains an Insertion of Sensitive… |
CVE-2026-4788 | High | 8.4 | 2026-04-08 | IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.37 stores sensitive information in log files that could be read by a local user. |
CVE-2026-27315 | Medium | 5.5 | 2026-04-07 | Sensitive Information Leak in cqlsh in Apache Cassandra 4.0 allows access to sensitive information, like passwords, from previously executed cqlsh command via… |
CVE-2026-35185 | High | 7.5 | 2026-04-06 | HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive… |
CVE-2019-25683 | Medium | 6.2 | 2026-04-05 | FileZilla 3.40.0 contains a denial of service vulnerability in the local search functionality that allows local attackers to crash the application by supplying… |
CVE-2026-4819 | Medium | 4.9 | 2026-03-31 | In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana. |
CVE-2026-32982 | High | 7.5 | 2026-03-31 | OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages… |
CVE-2026-4957 | Low | 2.7 | 2026-03-27 | A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle_tool_call of the file XAgent/function_handler.py of… |
CVE-2024-11604 | | 2026-03-27 | Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows… | |
CVE-2025-36187 | Medium | 4.4 | 2026-03-25 | IBM Knowledge Catalog Standard Cartridge 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1 stores potentially sensitive information in log fil… |
CVE-2026-28868 | Medium | 5.5 | 2026-03-25 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5… |
CVE-2026-20668 | Medium | 5.5 | 2026-03-25 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.5… |
CVE-2026-32598 | Medium | 6.5 | 2026-03-13 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containin… |
CVE-2026-0520 | Low | 2.8 | 2026-03-11 | A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authenticated user to retrie… |
CVE-2026-20165 | Medium | 6.3 | 2026-03-11 | In Splunk Enterprise versions below 10.2.1, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.7, 10.1.2507.17, 10.0.2503.12, and 9… |
CVE-2026-21791 | Low | 3.3 | 2026-03-10 | HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL |
CVE-2025-70040 | Medium | 5.3 | 2026-03-09 | An issue pertaining to CWE-532: Insertion of Sensitive Information into Log File was discovered in LupinLin1 jimeng-web-mcp v2.1.2. This allows an attacker to… |
CVE-2026-29184 | Low | 2.0 | 2026-03-07 | Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism t… |
CVE-2026-24308 | High | 7.5 | 2026-03-07 | Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information s… |
CVE-2026-21786 | Low | 3.3 | 2026-03-05 | HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs. |
CVE-2025-62879 | Medium | 6.8 | 2026-03-04 | A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-b… |
CVE-2026-1265 | Medium | 4.3 | 2026-03-03 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to writing of sensitive Information in a log file. |
CVE-2025-48635 | High | 7.7 | 2026-03-02 | In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This could lead to loc… |