Total
1319 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-31249 | 1 Wpkube | 1 Subscribe To Comments Reloaded | 2026-08-12 | N/A | 5.3 MEDIUM |
| Insertion of Sensitive Information into Log File vulnerability in WPKube Subscribe To Comments Reloaded.This issue affects Subscribe To Comments Reloaded: from n/a through 220725. | |||||
| CVE-2024-31245 | 1 Convertkit | 1 Convertkit - Email Marketing\, Email Newsletter And Landing Pages | 2026-08-12 | N/A | 5.3 MEDIUM |
| Insertion of Sensitive Information into Log File vulnerability in ConvertKit.This issue affects ConvertKit: from n/a through 2.4.5. | |||||
| CVE-2024-9621 | 2026-08-08 | N/A | 5.3 MEDIUM | ||
| A vulnerability was found in Quarkus CXF. Passwords and other secrets may appear in the application log in spite of the user configuring them to be hidden. This issue requires some special configuration to be vulnerable, such as SOAP logging enabled, application set client, and endpoint logging properties, and the attacker must have access to the application log. | |||||
| CVE-2026-1918 | 1 Ibm | 2 Sterling B2b Integrator, Sterling File Gateway | 2026-08-03 | N/A | 4.9 MEDIUM |
| IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 stores potentially sensitive information in log files that could be read by a privileged user. | |||||
| CVE-2026-44105 | 2026-07-30 | N/A | 6.6 MEDIUM | ||
| The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted. | |||||
| CVE-2026-62211 | 1 Openclaw | 1 Openclaw | 2026-07-29 | N/A | 5.0 MEDIUM |
| OpenClaw versions before 2026.6.1 contain a credential redaction bypass vulnerability in the trajectory export feature that allows lower-trust callers to access data that should remain within trusted boundaries. Attackers can exploit misconfigured input paths or feature accessibility to expose sensitive credentials and data through the export mechanism. | |||||
| CVE-2026-32982 | 1 Openclaw | 1 Openclaw | 2026-07-25 | N/A | 7.5 HIGH |
| OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. When media downloads fail, the original Telegram file URLs containing bot tokens are embedded in MediaFetchError strings and leaked to logs and error surfaces. | |||||
| CVE-2019-25683 | 1 Filezilla-project | 1 Filezilla Client | 2026-07-24 | N/A | 6.2 MEDIUM |
| FileZilla 3.40.0 contains a denial of service vulnerability in the local search functionality that allows local attackers to crash the application by supplying a malformed path string. Attackers can trigger the crash by entering a crafted path containing 384 'A' characters followed by 'BBBB' and 'CCCC' sequences in the search directory field and initiating a local search operation. | |||||
| CVE-2026-35185 | 1 Psu | 1 Haxiam | 2026-07-24 | N/A | 7.5 HIGH |
| HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and server configuration details. This allows any unauthenticated user to monitor real-time user interactions and gather internal infrastructure information. This vulnerability is fixed in 25.0.0. | |||||
| CVE-2026-4788 | 1 Ibm | 1 Tivoli Netcool\/impact | 2026-07-24 | N/A | 8.4 HIGH |
| IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.37 stores sensitive information in log files that could be read by a local user. | |||||
| CVE-2026-4819 | 1 Search-guard | 1 Flx | 2026-07-24 | N/A | 4.9 MEDIUM |
| In Search Guard FLX versions from 1.0.0 up to 4.0.1, the audit logging feature might log user credentials from users logging into Kibana. | |||||
| CVE-2026-28261 | 1 Dell | 2 Elastic Cloud Storage, Objectscale | 2026-07-24 | N/A | 7.8 HIGH |
| Dell Elastic Cloud Storage, version 3.8.1.7 and prior, and Dell ObjectScale, versions prior to 4.1.0.3 and version 4.2.0.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to secret exposure. The attacker may be able to use the exposed secret to access the vulnerable system with privileges of the compromised account. | |||||
| CVE-2025-13755 | 1 Ibm | 1 Db2 | 2026-07-24 | N/A | 5.5 MEDIUM |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes DB2 Connect Server) stores potentially sensitive information in log files that could be read by a local user. | |||||
| CVE-2021-21508 | 2026-07-23 | N/A | 6.7 MEDIUM | ||
| Dell VxRail versions before 7.0.200 contain a Plain-text Password Storage Vulnerability in VxRail Manager. A sys-admin user may exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. | |||||
| CVE-2026-8671 | 3 Avantra, Linux, Microsoft | 3 Avantra, Linux Kernel, Windows | 2026-07-23 | N/A | 7.5 HIGH |
| Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows Resource Leak Exposure. This issue affects Avantra: before 25.3.0. | |||||
| CVE-2026-44052 | 2026-07-23 | N/A | 7.5 HIGH | ||
| Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDAP credentials. | |||||
| CVE-2026-20239 | 1 Splunk | 2 Splunk, Splunk Cloud Platform | 2026-07-23 | N/A | 7.5 HIGH |
| In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the `_internal` index could view session cookies and response bodies that contain sensitive data. | |||||
| CVE-2026-9751 | 1 Mongodb | 1 Mongodb | 2026-07-23 | N/A | 5.5 MEDIUM |
| The ldapQueryPassword parameter, when set through the runtime setParameter command, will log the new password to the mongod.log file in plain text. | |||||
| CVE-2026-0267 | 1 Paloaltonetworks | 1 Globalprotect | 2026-07-23 | N/A | 5.5 MEDIUM |
| An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a local user to learn the configured passcodes for disabling, disconnecting, or uninstalling the GlobalProtect app. After the passcode is known, the user can perform these actions even if the GlobalProtect app configuration would not normally permit them to do so. | |||||
| CVE-2026-9735 | 1 Mongodb | 1 Mongodb | 2026-07-23 | N/A | 5.5 MEDIUM |
| MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction. | |||||