Total
1319 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-13750 | 1 Snowflake | 1 Snowflake Cli | 2026-10-25 | N/A | 5.5 MEDIUM |
| Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug logs. An attacker could exploit this by obtaining read access to the affected user's local log files, causing credentials such as passwords, tokens, or private key material to be exposed without additional application-level safeguards. Successful exploitation requires credentials to be present in the affected connection context and the resulting logs to be accessible from the local environment. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade. | |||||
| CVE-2026-56457 | 1 Hcltechsw | 2 Hcl Devops Deploy, Hcl Launch | 2026-10-25 | N/A | 4.3 MEDIUM |
| HCL DevOps Deploy / HCL Launch is susceptible to an exposure of sensitive information vulnerability in output logs. This exposure could allow an attacker with access to the logs to potentially obtain sensitive values related to that step. | |||||
| CVE-2026-46467 | 1 Dell | 1 Data Domain Operating System | 2026-10-25 | N/A | 5.8 MEDIUM |
| Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an insertion of sensitive information into log file vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure. | |||||
| CVE-2026-12086 | 1 Ibm | 2 Devops Deploy, Urbancode Deploy | 2026-10-25 | N/A | 6.2 MEDIUM |
| IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy stores potentially sensitive information in log files that could be read by a local user. | |||||
| CVE-2026-54652 | 2026-10-25 | N/A | 8.1 HIGH | ||
| Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credentials logged in request query strings and enabling viewer-to-admin privilege escalation. A fixed release has not been identified. | |||||
| CVE-2026-56459 | 1 Hcltechsw | 2 Hcl Devops Deploy, Hcl Launch | 2026-10-25 | N/A | 6.2 MEDIUM |
| HCL DevOps Deploy / HCL Launch is susceptible to sensitive information disclosure. The application stores potentially sensitive information in log files that could be read by a local user. | |||||
| CVE-2026-49088 | 1 Elastic | 1 Kibana | 2026-10-25 | N/A | 4.4 MEDIUM |
| Insertion of Sensitive Information into Log File (CWE-532) in Kibana can lead to information disclosure. When the optional application performance monitoring (APM) instrumentation is enabled, sensitive request header values could be recorded in application logs, where they may be accessible to operators with log access. | |||||
| CVE-2026-54704 | 1 Linuxfoundation | 1 Opentelemetry Instrumentation For Java | 2026-10-25 | N/A | 6.5 MEDIUM |
| OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.28.0, the JDBC auto-instrumentation may fail to sanitize passwords in SQL CONNECT statements when the password is double-quoted. As a result, clear-text database passwords can be added to trace span attributes and exported to observability backends. This issue has been fixed in version 2.28.0. | |||||
| CVE-2026-22098 | 2026-10-24 | N/A | N/A | ||
| Various sensitive information such as passwords and charging card UIDs are written to log files. | |||||
| CVE-2026-40633 | 1 Dell | 1 Powerscale Onefs | 2026-10-24 | N/A | 7.8 HIGH |
| Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 through 9.13.0.2 contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. | |||||
| CVE-2026-46514 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext password and fm_add_extension in Tools/AddExtension.php:172 returned a plaintext secret; Frogman.class.php:2207-2211 used auditOutcome to JSON-encode those responses into oc_audit_log.detail, allowing any PERM_READ caller with access to fm_audit_search to recover the stored credentials. This issue is fixed in version 1.6.2. | |||||
| CVE-2026-15737 | 2026-10-24 | N/A | 5.7 MEDIUM | ||
| AWS Bedrock AgentCore Python SDK is an open-source Python library that provides client tools for building AI agents on the Amazon Bedrock AgentCore platform. Unintended logging of sensitive user content in the OpenTelemetry instrumentation in AWS Bedrock AgentCore Python SDK versions 1.4.8 and 1.5.0 might allow a local authenticated user with access to CloudWatch Logs to access raw user prompts and agent responses containing sensitive data via span attributes. The SDK wrote raw user prompts and complete agent responses into OpenTelemetry span attributes on every invocation without filtering or masking. These spans flow into the customer's aws/spans CloudWatch log group, exposing sensitive content to any principal with log read access. We recommend you upgrade to version 1.5.1 or later. Users who ran affected versions should also review and purge sensitive content from their aws/spans CloudWatch log groups. | |||||
| CVE-2026-44969 | 1 Getdbt | 1 Dbt Mcp Server | 2026-10-24 | N/A | 2.5 LOW |
| dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and configure_file_logging() wrote those records to dbt-mcp.log when DBT_MCP_SERVER_FILE_LOGGING=true, preserving sensitive sql_query, vars, and node_selection values in plaintext without automatic rotation or deletion. This issue is fixed in version 1.17.1. | |||||
| CVE-2026-65945 | 1 Apache | 1 Ranger | 2026-10-24 | N/A | 6.5 MEDIUM |
| Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue. | |||||
| CVE-2026-68969 | 1 Apache | 1 Airflow | 2026-10-24 | N/A | 6.5 MEDIUM |
| Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover those secrets verbatim, and the Connection `extra` copy is stored unencrypted in the log while the connection table encrypts it. The Airflow UI's *Import Variables* action posts to this endpoint, so an ordinary operator import wrote every secret in the file to the log. This is a different code path from CVE-2026-50204: that fix shipped in 3.3.0 and covers the single-entity endpoints only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later. | |||||
| CVE-2026-71474 | 1 Redhat | 2 Advanced Cluster Management For Kubernetes, Insights-client | 2026-10-24 | N/A | 7.1 HIGH |
| A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services. | |||||
| CVE-2026-71845 | 1 Redhat | 2 Advanced Cluster Management For Kubernetes, Insights-client | 2026-10-24 | N/A | 6.3 MEDIUM |
| A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API. | |||||
| CVE-2026-64800 | 1 Jetbrains | 1 Goland | 2026-10-24 | N/A | 3.5 LOW |
| In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default | |||||
| CVE-2026-14528 | 1 Ibm | 1 Websphere Application Server | 2026-10-23 | N/A | 7.4 HIGH |
| IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information. | |||||
| CVE-2026-12947 | 1 Ibm | 1 App Connect Enterprise | 2026-10-23 | N/A | 7.5 HIGH |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user. | |||||