The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability (CVE-2026-87993) is fixed in consul-template 0.43.0.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
CVE-2025-46808 is a vulnerability in SUSE neuvector manager versions before 5.4.5 that allows sensitive information to be inserted into the manager container's log files. This exposure could lead to unauthorized disclosure of sensitive data. The vulnerability has a medium severity with a CVSS score of 6.8. It requires low privileges and user interaction to exploit and impacts confidentiality without affecting integrity or availability.
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
CVE-2026-68873 is a vulnerability in the Windows Program Compatibility Assistant Service on Microsoft Windows 11 version 23H2. It involves the insertion of sensitive information into log files, which allows an authorized local attacker to disclose this information. The vulnerability has a medium severity with a CVSS score of 5.5. Microsoft has released official fixes for affected versions.
CVE-2026-86501 is a low-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.2.2 where terminal command inputs could be written to the idea.log file. This issue is categorized under CWE-532, which involves exposure of information through log files. The vulnerability does not impact integrity or availability and requires local privileges with user interaction to exploit.
Dell Secure Connect Gateway (SCG) 5.0 versions prior to 5.36.00.16 (appliance) and 5.36.00.00 (application) contain a vulnerability where sensitive information may be inserted into log files. This could allow a low privileged local attacker to access sensitive data through log exposure. The vulnerability has a medium severity with a CVSS score of 5.5.
CVE-2026-16689 is a vulnerability in IBM App Connect Enterprise and IBM Integration Bus for z/OS where sensitive information, such as credentials, may be improperly logged. This affects versions 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28, and 10.1.0.0 through 10.1.0.7. The vulnerability allows a local attacker to obtain sensitive information from log files. The CVSS 3.1 base score is 6.2, indicating a medium severity. There is no indication of known exploits in the wild or available patches in the provided data.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to credentials being written to trace logs in cleartext.
CVE-2026-19649 is a vulnerability in IBM App Connect Enterprise and IBM Integration Bus for z/OS that allows local attackers to obtain sensitive information due to improper logging of database credentials. The affected versions include App Connect Enterprise 13.0.1.0 through 13.0.8.1, 12.0.1.0 through 12.0.12.28, and Integration Bus for z/OS 10.1.0.0 through 10.1.0.7. The vulnerability is classified under CWE-532, which involves insertion of sensitive information into log files. The CVSS v3.1 base score is 6.2, indicating a medium severity level. There is no indication of known exploits in the wild or available patches from the provided data.
Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged values could include access tokens, refresh tokens, authorization codes, agent tokens, direct-post codes, ID tokens, VP tokens, and tokens submitted to introspection or revocation endpoints. An attacker with access to Boruta logs, log aggregation systems, or the administration log viewer could recover these credentials and use them until expiration or revocation. This issue has been patched in version 0.10.0.
CVE-2026-78174 is a critical vulnerability in WatchGuard Dimension version 2.0 where unredacted session identifiers for logged-in users are recorded in the web UI diagnostic log. A low-privileged Dimension Administrator can access this log and extract a Super Administrator's session token while the latter is logged in, potentially allowing account takeover.
CVE-2026-81530 is a vulnerability in the MongoDB C# Driver version 2.10.0 where sensitive key-management credentials are logged in plaintext in diagnostic outputs. This occurs because the driver fails to mask these credentials in its human-readable client settings representation. An attacker with access to application logs, diagnostic output, or process memory dumps could recover these plaintext credentials and potentially decrypt protected field data.
CVE-2026-59302 is a low severity vulnerability in Spring Cloud Stream where sensitive information may be inserted into log files. It affects multiple versions of Spring Cloud Stream including 4.2.0 through 4.2.6, 4.3.0 through 4.3.3, and 5.0.0 through 5.0.2. The vulnerability involves potential exposure of sensitive data through logging, classified under CWE-532. No official patch or remediation guidance is currently available.
CVE-2026-59301 is a low-severity vulnerability in Spring Cloud Function that involves the potential insertion of sensitive information into log files. It affects specific versions of Spring Cloud Function, including 4.2.0 through 4.2.7, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.3. The vulnerability relates to CWE-532, which concerns the improper logging of sensitive data. The affected product is a cloud service, and the vendor manages remediation for this type of service. No known exploits are reported in the wild.
CVE-2026-59300 is a low severity vulnerability in Spring Cloud Function that involves the potential insertion of sensitive information into log files. It affects multiple versions of Spring Cloud Function, including 3.2.16 and earlier, 4.2.0 through 4.2.7, 4.3.0 through 4.3.4, and 5.0.0 through 5.0.3. The vulnerability relates to logging sensitive data in the AWS environment. A patch is available, and since this is a cloud service, the vendor typically manages remediation server-side.
CVE-2026-75573 is a medium severity vulnerability in MongoDB Connector for BI version 2.12.0 where the mongodrdl tool may write a TLS private-key password to standard error if the password is supplied both via the connection URI and command-line option. This disclosure could allow a local user with access to the command output and encrypted key file to obtain the password and access the TLS client key.
CVE-2026-21808 is a medium severity vulnerability in HCL BigFix Quantum Risk Analyzer version 2.0.1.47. The product generates highly detailed logs by default, which can inadvertently include sensitive information. This logging behavior increases the risk of sensitive data leakage and may expose internal application logic and architectural details to an attacker. There is no official patch or remediation guidance available at this time.
CVE-2026-58070 is a vulnerability in Veeam Backup and Replication where guest OS processing credentials are recorded in cleartext within a support log on the guest system. This allows any user with read access to that log to recover privileged account credentials. The vulnerability has a medium severity rating with a CVSS score of 6.8. No specific affected versions or patches are currently documented.