Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,387

Export CSV
CVE-2020-37267

Renovate 19.180.0 before 23.25.1 Token Leakage via Logs

Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Renovatebot
Products
Renovate
CVE-2026-59326

HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server

The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentials in the form http://user:pass@proxy:8080, and the language server writes this value to its log file without any redaction. Since language server log files are often attached to bug reports or are readable by other local users/processes, this can result in disclosure of proxy credentials. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier Spring Tools for VSCode / Cursor / Theia: 2.2.0 and earlier

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Broadcom Spring
Products
Spring Tools Spring Tools For Eclipse Spring Tools For Vscode / Cursor / Theia
CVE-2026-16689

IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of credentials.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
App Connect Enterprise Integration Bus For Z\/os Integration Bus For Zos
CVE-2026-85174

SiYuan before v3.8.2 API Token Exposure via Log File

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-59301

Potential for logging sensitive data in Spring Cloud Function Azure

Potential for logging sensitive data in Spring Cloud Function Azure. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Cloud Function Spring Cloud Function
CVE-2022-31684

reactor-netty-http: Log request headers in some cases of invalid HTTP requests

Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Broadcom Redhat
Products
Reactor Netty Camel Spring Boot Openshift Application Runtimes
CVE-2026-14948

Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insertion of Sensitive Information into Log File via error log archives

A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Frauscher Sensortechnik
Products
Fds 102
CVE-2026-75485

Must-gather: /tmp/kubeconfig retention

A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Advanced Cluster Management For Kubernetes
CVE-2026-71474

Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Advanced Cluster Management For Kubernetes Insights-client
CVE-2026-59300

Potential for logging sensitive data in Spring Cloud Function AWS

Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Cloud Function Spring Cloud Function
CVE-2026-14163

Information Exposure of Sensitive Variables in Octopus Deploy Server Deployment Snapshots

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Octopus
Products
Octopus Server
CVE-2026-55785

free5GC AUSF uses non-constant-time authentication comparisons and logs XRES* in 5G-AKA

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptographic authentication comparisons in internal/sbi/processor/ue_authentication.go with ordinary equality helpers. Auth5gAkaComfirmRequestProcedure compares RES* and XRES* with strings.EqualFold and logs the expected XRES* value at INFO level before comparison. EapAuthComfirmRequestProcedure compares AT_MAC and XMAC with bytes.Equal and evaluates XRES == RES with ordinary string equality. These comparisons can return at mismatch-dependent times, although testing did not demonstrate a practical remote timing oracle because of HTTP/SBI timing noise. The INFO log exposes authentication material to operators, log collectors, sidecars, or processes able to read AUSF logs. This issue is fixed in version 1.4.5.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Free5gc
Products
Free5gc
CVE-2026-21808

HCL BigFix Quantum Risk Analyzer is affected by logging sensitive information

HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an attacker with internal application logic and architectural details.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hclsoftware
Products
Bigfix Quantum Risk Analyzer
CVE-2026-78174

WatchGuard Dimension Session Hijack via Exposed Session Tokens in Diagnostic Logs

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Dimension
CVE-2026-58070

Cleartext Credential Logging in Support Logs

A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Veeam
Products
Backup And Replication
CVE-2026-71845

Insights-client: insights-client: ccx_token bearer credential logged in clear text at startup via setdefault()

A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Advanced Cluster Management For Kubernetes Insights-client
CVE-2019-25766

Renovate before 19.38.7 Credential Exposure via Go Modules

Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Renovatebot
Products
Renovate
CVE-2019-1961

Cisco Enterprise NFV Infrastructure Software Web Portal Arbitrary File Read Vulnerability

A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to the improper input validation of tar packages uploaded through the Web Portal to the Image Repository. An attacker could exploit this vulnerability by uploading a crafted tar package and viewing the log entries that are generated. A successful exploit could allow the attacker to read arbitrary files on the underlying OS.

CVSS 3.1 · 4.9 Medium EPSS 1.9% KEV · Not listed
Vendors
Cisco
Products
Enterprise Nfv Infrastructure Software
CVE-2019-1953

Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability

A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced to modify the default password when logging in to the web portal for the first time. Subsequent password changes are not logged and other accounts are not affected. An attacker could exploit this vulnerability by viewing the admin clear text password and using it to access the affected system. The attacker would need a valid user account to exploit this vulnerability.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Cisco
Products
Enterprise Nfv Infrastructure Software
CVE-2026-64590

dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning

In the Linux kernel, the following vulnerability has been resolved: dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning When CONFIG_DMA_API_DEBUG_SG is enabled, importing a udmabuf into a DRM driver (e.g. amdgpu for video playback in GNOME Videos / Showtime) triggers a spurious warning: DMA-API: amdgpu 0000:03:00.0: cacheline tracking EEXIST, \ overlapping mappings aren't supported WARNING: kernel/dma/debug.c:619 at add_dma_entry+0x473/0x5f0 The call chain is: amdgpu_cs_ioctl -> amdgpu_ttm_backend_bind -> dma_buf_map_attachment -> [udmabuf] map_udmabuf -> get_sg_table -> dma_map_sgtable(dev, sg, direction, 0) // attrs=0 -> debug_dma_map_sg -> add_dma_entry -> EEXIST This happens because udmabuf builds a per-page scatter-gather list via sg_set_folio(). When begin_cpu_udmabuf() has already created an sg table mapped for the misc device, and an importer such as amdgpu maps the same pages for its own device via map_udmabuf(), the DMA debug infrastructure sees two active mappings whose physical addresses share cacheline boundaries and warns about the overlap. The DMA_ATTR_SKIP_CPU_SYNC flag suppresses this check in add_dma_entry() because it signals that no CPU cache maintenance is performed at map/unmap time, making the cacheline overlap harmless. All other major dma-buf exporters already pass this flag: - drm_gem_map_dma_buf() passes DMA_ATTR_SKIP_CPU_SYNC - amdgpu_dma_buf_map() passes DMA_ATTR_SKIP_CPU_SYNC The CPU sync at map/unmap time is also redundant for udmabuf: begin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit cache synchronization via dma_sync_sgtable_for_cpu/device() when CPU access is requested through the dma-buf interface. Pass DMA_ATTR_SKIP_CPU_SYNC to dma_map_sgtable() and dma_unmap_sgtable() in udmabuf to suppress the spurious warning and skip the redundant sync.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel