Total
1233 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-47234 | 2026-09-09 | N/A | 4.4 MEDIUM | ||
| Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live bearer-style credentials from the logs. Version 5.0.10 contains a fix. | |||||
| CVE-2026-79966 | 1 Dell | 1 Secure Connect Gateway | 2026-09-09 | N/A | 3.3 LOW |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure. | |||||
| CVE-2026-80169 | 1 Dell | 1 Secure Connect Gateway | 2026-09-09 | N/A | 3.3 LOW |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure. | |||||
| CVE-2026-19649 | 1 Ibm | 2 App Connect Enterprise, Integration Bus For Z\/os | 2026-09-09 | N/A | 6.2 MEDIUM |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of database credentials. | |||||
| CVE-2026-68873 | 2026-09-08 | N/A | 5.5 MEDIUM | ||
| Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-55785 | 2026-09-08 | N/A | 3.7 LOW | ||
| free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES* and XRES* with strings.EqualFold and logs the expected XRES* value at INFO level before comparison. EapAuthComfirmRequestProcedure compares AT_MAC and XMAC with bytes.Equal and evaluates XRES == RES with ordinary string equality. These comparisons can return at mismatch-dependent times, although testing did not demonstrate a practical remote timing oracle because of HTTP/SBI timing noise. The INFO log exposes authentication material to operators, log collectors, sidecars, or processes able to read AUSF logs. This issue is fixed in version 1.4.5. | |||||
| CVE-2019-25766 | 2026-09-08 | N/A | 7.5 HIGH | ||
| Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens. | |||||
| CVE-2020-37267 | 2026-09-08 | N/A | 7.5 HIGH | ||
| Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed. | |||||
| CVE-2026-85174 | 2026-09-08 | N/A | 8.8 HIGH | ||
| SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access. | |||||
| CVE-2026-85171 | 2026-09-08 | N/A | N/A | ||
| n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API. | |||||
| CVE-2026-59326 | 1 Broadcom | 1 Spring Tools | 2026-09-08 | N/A | 3.3 LOW |
| The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentials in the form http://user:pass@proxy:8080, and the language server writes this value to its log file without any redaction. Since language server log files are often attached to bug reports or are readable by other local users/processes, this can result in disclosure of proxy credentials. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier | |||||
| CVE-2026-16689 | 1 Ibm | 2 App Connect Enterprise, Integration Bus For Z\/os | 2026-09-08 | N/A | 6.2 MEDIUM |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of credentials. | |||||
| CVE-2026-86501 | 2026-09-08 | N/A | 2.8 LOW | ||
| In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log | |||||
| CVE-2026-75485 | 2026-09-05 | N/A | 5.5 MEDIUM | ||
| A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive. | |||||
| CVE-2026-71845 | 1 Redhat | 2 Advanced Cluster Management For Kubernetes, Insights-client | 2026-09-05 | N/A | 6.3 MEDIUM |
| A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API. | |||||
| CVE-2026-71474 | 1 Redhat | 2 Advanced Cluster Management For Kubernetes, Insights-client | 2026-09-05 | N/A | 7.1 HIGH |
| A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services. | |||||
| CVE-2026-59301 | 1 Vmware | 1 Spring Cloud Function | 2026-09-04 | N/A | 3.1 LOW |
| Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 | |||||
| CVE-2022-31684 | 1 Broadcom | 1 Reactor Netty | 2026-09-04 | N/A | 4.3 MEDIUM |
| Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled. | |||||
| CVE-2026-58070 | 2026-09-03 | N/A | N/A | ||
| A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials. | |||||
| CVE-2026-14948 | 2026-09-03 | N/A | 8.8 HIGH | ||
| A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives. | |||||