CWE-532 · Insertion of Sensitive Information into Log File (page 3)
Page 3 of 13 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27900 | Medium | 5.0 | 2026-02-26 | The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackScript content, and object storage data… |
CVE-2025-0976 | Medium | 4.7 | 2026-02-25 | Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager.This issue affects Hitachi Ops Center API Con… |
CVE-2025-5781 | Medium | 5.2 | 2026-02-25 | Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager, Hitachi Device Manager allows Session Hijack… |
CVE-2025-27555 | Medium | 6.5 | 2026-02-24 | Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they shou… |
CVE-2026-2605 | Medium | 5.3 | 2026-02-20 | Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS. |
CVE-2026-2350 | Medium | 6.5 | 2026-02-20 | Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS. |
CVE-2026-1292 | Medium | 6.5 | 2026-02-20 | Tanium addressed an insertion of sensitive information into log file vulnerability in Trends. |
CVE-2026-20144 | Medium | 6.8 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11, and Splunk Cloud Platform versions below 10.2.2510.0, 10.1.2507.11, 10.0.2503.9… |
CVE-2026-20142 | Medium | 6.8 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with acc… |
CVE-2026-20138 | Medium | 6.8 | 2026-02-18 | In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with acc… |
CVE-2026-20663 | Low | 3.3 | 2026-02-11 | The issue was resolved by sanitizing logging. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An app may be able to enumerate a… |
CVE-2026-20646 | Low | 3.3 | 2026-02-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.3. A malicious app may be able to read sensitive location inf… |
CVE-2026-1495 | Medium | 6.5 | 2026-02-10 | The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including URL and proxy crede… |
CVE-2026-21222 | Medium | 5.5 | 2026-02-10 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-11547 | High | 7.8 | 2026-02-10 | AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user. |
CVE-2026-25918 | Medium | 5.5 | 2026-02-09 | unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive cr… |
CVE-2026-25813 | High | 7.5 | 2026-02-09 | PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to consol… |
CVE-2026-25846 | Medium | 6.5 | 2026-02-09 | In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs |
CVE-2025-15332 | Medium | 4.9 | 2026-02-05 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2026-22038 | High | 8.1 | 2026-02-04 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autog… |
CVE-2026-1622 | | 2026-02-04 | Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a potential information disclosure by a user who has ability… | |
CVE-2026-24762 | High | 7.5 | 2026-02-03 | RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material (access key, secret… |
CVE-2026-22778 | Critical | 9.8 | 2026-02-02 | vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpo… |
CVE-2026-25211 | Low | 3.2 | 2026-01-30 | Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log. |
CVE-2026-0936 | Medium | 5.0 | 2026-01-29 | An Insertion of Sensitive Information into Log File vulnerability in B&R PVI client versions prior to 6.5 may be abused by an authenticated local attacker to g… |
CVE-2025-13925 | Medium | 4.9 | 2026-01-20 | IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged user. |
CVE-2025-59355 | Medium | 6.5 | 2026-01-19 | A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records the complete input parameter string in t… |
CVE-2026-0519 | Low | 3.4 | 2026-01-17 | In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations. Any party… |
CVE-2025-43508 | Medium | 5.5 | 2026-01-16 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2026-22782 | High | 7.5 | 2026-01-16 | RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared… |
CVE-2025-68675 | High | 7.5 | 2026-01-16 | In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication… |
CVE-2026-23493 | High | 8.6 | 2026-01-15 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variable… |
CVE-2026-20818 | Medium | 6.2 | 2026-01-13 | Insertion of sensitive information into log file in Windows Kernel allows an unauthorized attacker to disclose information locally. |
CVE-2026-22798 | Medium | 5.9 | 2026-01-12 | hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take a… |
CVE-2025-68919 | Medium | 5.6 | 2025-12-24 | Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12, when collected maintenance data is accessibl… |
CVE-2025-66910 | Medium | 6.0 | 2025-12-19 | Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService… |
CVE-2025-14437 | High | 7.5 | 2025-12-18 | The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request'… |
CVE-2025-46277 | Low | 3.3 | 2025-12-17 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, watchOS 26.2. An app may be able… |
CVE-2025-43475 | Medium | 5.5 | 2025-12-17 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2. An app may be able to access user-sensitive data. |
CVE-2025-13321 | Low | 3.3 | 2025-12-17 | Mattermost Desktop App versions <6.0.0 fail to sanitize sensitive information from Mattermost logs and clear data on server deletion which allows an attacker w… |
CVE-2025-14432 | Medium | 4.9 | 2025-12-16 | In limited scenarios, sensitive data might be written to the log file if an admin uses Microsoft Teams Admin Center (TAC) to make device configuration changes… |
CVE-2025-43517 | Low | 3.3 | 2025-12-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tah… |
CVE-2025-13743 | High | 7.5 | 2025-12-09 | Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization. This poses a risk of leaking sensiti… |
CVE-2024-47570 | Medium | 6.6 | 2025-12-09 | An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7… |
CVE-2025-64650 | Medium | 6.5 | 2025-12-08 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files. |
CVE-2020-36876 | | 2025-12-05 | ReQuest Serious Play F3 Media Server versions 7.0.3.4968 (Pro), 7.0.2.4954, 6.5.2.4954, 6.4.2.4681, 6.3.2.4203, and 2.0.1.823 allows unauthenticated attackers… | |
CVE-2025-12996 | Medium | 4.1 | 2025-12-04 | Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under cert… |
CVE-2025-14010 | Medium | 5.5 | 2025-12-04 | A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaint… |
CVE-2025-66411 | High | 7.8 | 2025-12-03 | Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containin… |
CVE-2025-13611 | Low | 2.0 | 2025-11-26 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 that could have allowed an authenticated u… |
CVE-2025-20373 | Low | 2.7 | 2025-11-26 | In Splunk Add-on for Palo Alto Networks versions below 2.0.2, the add-on exposes client secrets in plain text in the _internal index during the addition of new… |
CVE-2025-63729 | Critical | 9.0 | 2025-11-25 | An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL Private Key, CA Certificate, SSL Certific… |
CVE-2025-11446 | Medium | 6.5 | 2025-11-19 | Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects… |
CVE-2025-54971 | Medium | 4.3 | 2025-11-18 | An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all versions, FortiADC 7.1 all versions, F… |
CVE-2025-62209 | Medium | 5.5 | 2025-11-11 | Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. |
CVE-2025-62208 | Medium | 5.5 | 2025-11-11 | Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. |
CVE-2025-12940 | Medium | 5.5 | 2025-11-11 | Login credentials are inadvertently recorded in logs if a Syslog Server is configured in NETGEAR WAX610 and WAX610Y (AX1800 Dual Band PoE Multi-Gig Insight Man… |
CVE-2025-11008 | Critical | 9.8 | 2025-11-04 | The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.1 via the log file. This makes it… |
CVE-2025-43426 | Medium | 5.5 | 2025-11-04 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1. An app may be able to access sen… |
CVE-2025-43423 | Low | 2.0 | 2025-11-04 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2… |
CVE-2025-40603 | Medium | 4.5 | 2025-10-31 | A potential exposure of sensitive information in log files in SonicWall SMA100 Series appliances may allow a remote, authenticated administrator, under certain… |
CVE-2025-62232 | High | 7.5 | 2025-10-31 | Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is… |
CVE-2025-58189 | Medium | 5.3 | 2025-10-29 | When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escap… |
CVE-2024-58269 | Medium | 4.3 | 2025-10-29 | A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster import URLs, and registration tokens, is… |
CVE-2025-62262 | Medium | 4.4 | 2025-10-27 | Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Lifera… |
CVE-2025-11248 | Low | 3.2 | 2025-10-27 | ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated user with acces… |
CVE-2025-11504 | High | 7.5 | 2025-10-24 | The Quickcreator – AI Blog Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 0.0.9 to 0.1.17 through the /wp-content/plug… |
CVE-2025-62705 | Medium | 4.9 | 2025-10-22 | OpenBao is an open source identity-based secrets management system. Prior to version 2.4.2, OpenBao's audit log did not appropriately redact fields when releva… |
CVE-2025-62513 | High | 7.5 | 2025-10-22 | OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP b… |
CVE-2025-46752 | Medium | 4.4 | 2025-10-16 | A insertion of sensitive information into log file in Fortinet FortiDLP 12.0.0 through 12.0.5, 11.5.1, 11.4.6, 11.4.5 allows attacker to information disclosure… |
CVE-2025-20329 | Medium | 4.9 | 2025-10-15 | A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software could allow an authenticated, remote attac… |
CVE-2025-10486 | Medium | 5.3 | 2025-10-15 | The Content Writer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.8 through publicly exposed lo… |
CVE-2025-59258 | Medium | 6.2 | 2025-10-14 | Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally. |
CVE-2025-59203 | Medium | 5.5 | 2025-10-14 | Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locally. |
CVE-2025-59197 | Medium | 5.5 | 2025-10-14 | Insertion of sensitive information into log file in Windows ETL Channel allows an authorized attacker to disclose information locally. |
CVE-2025-47979 | Medium | 5.5 | 2025-10-14 | Insertion of sensitive information into log file in Windows Failover Cluster allows an authorized attacker to disclose information locally. |
CVE-2025-31514 | Low | 2.7 | 2025-10-14 | A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, F… |
CVE-2025-37727 | Medium | 5.7 | 2025-10-10 | Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the… |
CVE-2025-10645 | Medium | 5.3 | 2025-10-07 | The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Licensing::log() method… |
CVE-2023-50301 | Low | 1.9 | 2025-10-01 | IBM Transformation Extender Advanced 10.0.1 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2025-36144 | Low | 3.3 | 2025-09-27 | IBM Lakehouse (watsonx.data 2.2) stores potentially sensitive information in log files that could be read by a local user. |
CVE-2025-9985 | Medium | 5.3 | 2025-09-26 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through pub… |
CVE-2025-34188 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (macOS/Linux client deployments) conta… |
CVE-2025-34183 | High | 7.5 | 2025-09-16 | Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retr… |
CVE-2025-43354 | Medium | 5.5 | 2025-09-15 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An a… |
CVE-2025-43303 | Medium | 5.5 | 2025-09-15 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An a… |
CVE-2025-4234 | | 2025-09-12 | A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these ap… | |
CVE-2025-54376 | High | 7.5 | 2025-09-10 | Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same… |
CVE-2025-43888 | High | 8.8 | 2025-09-10 | Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privil… |
CVE-2025-10221 | Medium | 5.5 | 2025-09-10 | Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft Axxon One / AxxonNet / C-WerkNet 2.0.4 and earlier on Window… |
CVE-2025-7445 | Medium | 6.5 | 2025-09-05 | Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs. |
CVE-2025-23261 | Medium | 5.5 | 2025-09-04 | NVIDIA Cumulus Linux and NVOS products contain a vulnerability, where hashed user passwords are not properly suppressed in log files, potentially disclosing in… |
CVE-2025-8663 | Medium | 6.5 | 2025-09-03 | Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects… |
CVE-2025-41690 | High | 7.4 | 2025-09-02 | A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. Thi… |
CVE-2025-36133 | Medium | 5.9 | 2025-09-01 | IBM App Connect Enterprise Certified Container CD: 9.2.0 through 11.6.0, 12.1.0 through 12.14.0, and 12.0 LTS: 12.0.0 through 12.0.14stores potentially sensiti… |
CVE-2025-57813 | Medium | 5.9 | 2025-08-26 | traQ is a messenger application built for Digital Creators Club traP. Prior to version 3.25.0, a vulnerability exists where sensitive information, such as OAut… |
CVE-2025-3456 | Low | 3.8 | 2025-08-25 | On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowl… |
CVE-2025-7426 | | 2025-08-25 | Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauthenticated remote ac… | |
CVE-2025-55285 | Low | 2.6 | 2025-08-15 | @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values… |
CVE-2025-38745 | Medium | 4.8 | 2025-08-14 | Dell OpenManage Enterprise, versions 3.10, 4.0, 4.1, and 4.2, contains an Insertion of Sensitive Information into Log File vulnerability in the Backup and Rest… |