Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager, Hitachi Device Manager allows Session Hijacking.This issue affects Hitachi Ops Center API Configuration Manager: from 10.0.0-00 before 11.0.5-00; Hitachi Configuration Manager: from 8.5.1-00 before 11.0.5-00; Hitachi Device Manager: from 8.4.1-00 before 8.6.5-00.
Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables appeared in the audit log and were stored unencrypted in the Airflow database. While this risk is limited to users with audit log access, it is recommended to upgrade to Airflow 2.11.1 or a later version, which addresses this issue. Users who previously used the CLI to set connections should manually delete entries with those connection sensitive values from the log table. This is similar but not the same issue as CVE-2024-50378
The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including URL and proxy credentials, from the PI to CONNECT event log files. This could enable unauthorized access to the proxy server.
CVE-2026-25918 is a medium severity vulnerability in the RageAgainstThePixel unity-cli tool prior to version 1.8.2. The sign-package command logs sensitive credentials such as email and password in plaintext when the --verbose flag is used. These credentials are output via JSON.stringify without sanitization, exposing secrets to shell history, CI/CD logs, and log aggregation systems. Exploitation requires local access and the use of the verbose flag, with no user interaction needed. The vulnerability risks credential leakage, potentially leading to unauthorized access or further compromise. It is fixed in version 1.8.
CVE-2026-25813 is a high-severity vulnerability in PlaciPy version 1.0.0, a placement management system used by educational institutions. The vulnerability involves the insertion of highly sensitive information directly into console logs without any masking or redaction, classified under CWE-532. This flaw allows an attacker with network access to potentially retrieve sensitive data from logs, as no authentication or user interaction is required. Although no known exploits are currently reported in the wild, the vulnerability's high CVSS score (8.7) reflects its critical impact on confidentiality. European educational institutions using PlaciPy 1.0.0 are at risk of sensitive data exposure, which could lead to privacy violations and regulatory non-compliance.
CVE-2026-25846 is a medium severity vulnerability in JetBrains YouTrack prior to version 2025.3.119033 where access tokens could be exposed in mailbox logs. This exposure stems from improper handling of sensitive information (CWE-532), potentially allowing attackers with network access and low privileges to obtain tokens without user interaction. While the vulnerability does not impact integrity or availability, the confidentiality breach could enable unauthorized access to YouTrack resources. No known exploits are currently reported in the wild. European organizations using affected YouTrack versions should prioritize updating to the patched release to prevent token leakage. Mitigation involves upgrading YouTrack, auditing mailbox logs for token exposure, and restricting log access. Countries with significant JetBrains YouTrack adoption, such as Germany, France, and the UK, are most likely to be impacted due to their large software development sectors. The vulnerability’s CVSS score of 6.
CVE-2026-22038 is a high-severity vulnerability in Significant-Gravitas AutoGPT versions prior to autogpt-platform-beta-v0.6.46. The issue involves the insertion of sensitive information, specifically API keys and authentication secrets, into log files in plaintext via logger.info() calls within three Stagehand integration blocks. This exposure can lead to confidentiality breaches and potential denial of service due to availability impact. The vulnerability requires network access and low privileges but no user interaction, making exploitation feasible in many environments. The flaw has been patched in version 0.6.46.
CVE-2026-1622 is a medium severity vulnerability in Neo4j Enterprise and Community editions prior to versions 2026.01.3 and 5.26.21. It involves the insertion of sensitive information into query log files due to incomplete obfuscation of error messages when the 'obfuscate_literals' option is enabled. A user with legitimate access to local log files and the ability to run queries that trigger errors can infer unauthorized information from unredacted error details. The vulnerability does not require user interaction but does require local log file access and some privileges to run queries. The issue is fixed in the specified patched versions, and a new configuration option 'db.logs.
vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this leak, we reduce ASLR from 4 billion guesses to ~8 guesses. This vulnerability can be chained a heap overflow with JPEG2000 decoder in OpenCV/FFmpeg to achieve remote code execution. This vulnerability is fixed in 0.14.1.
An Insertion of Sensitive Information into Log File vulnerability in B&R PVI client versions prior to 6.5 may be abused by an authenticated local attacker to gather credential information which is processed by the PVI client application. The logging function of the PVI client application is disabled by default and must be explicitly enabled by the user.
CVE-2025-59355 is a medium severity vulnerability in Apache Linkis versions 1.0.0 through 1.7.0 where sensitive information such as Hive Metastore passwords can be exposed in log files if Base64 decoding fails. The vulnerability arises because the decode failure logs the entire input string, potentially containing plaintext secrets, at the error level. This leakage requires that the configuration contains invalid Base64 strings and that log files are accessible to unauthorized users. Apache Linkis 1.8.0 and later mitigate this by logging only desensitized error messages.
In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed.
Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or later for Airflow 2 which fixes this issue
CVE-2026-22798 is a medium severity vulnerability in the softwarepub hermes tool versions 0.8.1 up to but not including 0.9.1. The issue arises because hermes logs arbitrary options passed via the -O argument in raw form, including sensitive data such as API tokens. This results in sensitive information being stored in plaintext within log files, exposing it to any user or process with access to those logs. Exploitation requires local access with limited privileges and some user interaction, but can lead to a compromise of integrity through token theft. The vulnerability has been fixed in version 0.9.
Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12, when collected maintenance data is accessible by a principal/authority other than ETERNUS SF Admin, allows an attacker to potentially affect system confidentiality, integrity, and availability.
The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensitive data including Cloudflare API credentials.
