Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,387

Export CSV
CVE-2026-18710

Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Java Driver Mongodb Server
CVE-2026-82371

Plaintext exposure of sensitive authentication data in SANnav discovery service log files

Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage exposed authentication details to compromise managed network infrastructure and access active application sessions. This vulnerability affects Brocade SANnav versions before 3.0.1a.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Brocade
Products
Sannav
CVE-2026-82372

Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.a

Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the potential exposure of keys used to secure network tunnels.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Brocade
Products
Sannav
CVE-2026-14442

Information exposure vulnerability in the job scheduling component of SANnav before 3.0.1a

An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters including external server passwords and archive protection keys are logged without proper masking. A local or authenticated user with access to application logs or support bundles can view these cleartext credentials, potentially leading to unauthorized access to remote backup targets or protected archives.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Brocade
Products
Sannav
CVE-2026-49810

Sensitive Data Logged to Event Log via Dell Command Powershell Provider

Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Dell
Products
Command Powershell Provider (dcpp)
CVE-2026-77285

OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from env_template to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after num_retries was reached. A process supervisor, log collector, or local user able to read that output could obtain the rendered secret values. This issue is fixed in version 2.6.0.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Openbao
Products
Openbao
CVE-2026-75573

MongoDB Connector for BI mongodrdl Logs TLS Private-Key Password When Duplicate Options Are Supplied

In MongoDB Connector for BI, mongodrdl may write a TLS private-key password to standard error when the password is supplied through both the connection URI and the corresponding command-line option. A local user with access to the captured command output and encrypted key file may use the disclosed password to access the associated TLS client key.

CVSS 4.0 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mongodb
Products
Bi Connector
CVE-2026-59302

Potential for logging sensitive data in Spring Cloud Stream

Potential for logging sensitive data in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Spring Vmware
Products
Spring Cloud Stream Spring Cloud Function
CVE-2026-95815

OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation prompts.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-78627

Improper Credential Protection in Okta Hyperdrive Integration Installer Logging

The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded in plaintext in the installer log, the Application Event Log, and the process command line, all of which are readable by an authenticated local user on the workstation.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Okta
Products
Hyperdrive Okta Hyperdrive Integration Plugin
CVE-2026-78631

Improper Restriction of Sensitive Information in Okta Hyperdrive Agent Logging

The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access to the log file.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Okta
Products
Hyperdrive Okta Hyperdrive Agent
CVE-2026-25826

Keyfactor SignServer Log Disclosure of Sensitive File Content via PKCS11CryptoToken

An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable file but not an accepted file (i.e., recognized with attributes). In this case, an error is thrown which - together with the error - also prints the content of the file to the application server log. This gives a user that has both SignServer admin access and access to read the output of the server log (i.e., if remote syslog shipping is configured), the possibility to read the content of files accessible by the local user JBoss.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Keyfactor
Products
Signserver
CVE-2026-84527

Improper Log Redaction Exposes Sensitive User Data

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ios And Ipados Ipados Iphone Os and 4 more
CVE-2026-84525

Log Redaction Flaw Exposes User Sensitive Data

A logging issue was addressed with improved data redaction. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access user-sensitive data.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Macos
CVE-2026-84513

Location Information Leakage Through Improper Log Redaction

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A malicious application may be able to determine a user's current location.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ios And Ipados Ipados Iphone Os and 4 more
CVE-2026-73442

On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving for

On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forwarded log output) to obtain the peer device VRRP authentication credentials without having access to the network segment on which VRRP is running.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Arista
Products
Eos
CVE-2026-86049

Jupyter Server: 5xx request logging leaks token-bearing Referer header values

Jupyter Server is the backend for Jupyter web applications. Prior to version 2.21.0, the 5xx request logging path in jupyter_server/log.py copies the Referer header into a JSON header block without applying the token scrubbing used for the request URI. A request that returns HTTP 500 while the Referer contains a token-bearing URL can therefore write that token to server logs in plaintext. An attacker who can read those logs can recover the token and use the affected user's Jupyter Server permissions. This issue is fixed in version 2.21.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Jupyter
Products
Jupyter Server
CVE-2026-73457

Under certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users.

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticated users.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Arista
Products
Eos
CVE-2026-92918

admin3 through 3.0.0 Session Token Disclosure via Audit Log

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Cjbi
Products
Admin3