CVE-2026-14948 is a vulnerability in Frauscher Sensortechnik FDS 102 versions 2.13.0 through 2.13.3. It allows a low privileged remote attacker to hijack an active administrative session by extracting plaintext session identifiers from downloadable error log archives. This flaw involves the insertion of sensitive information into log files, specifically live session tokens, which can be exploited without knowing the administrator password.
A critical vulnerability exists in the submariner-operator component where the `submariner-k8s-broker-cluster` Role assigned to joined clusters has excessive permissions. This flaw allows a compromised cluster to overwrite endpoint information of other clusters, enabling an attacker to redirect inter-cluster tunnel traffic and perform a Man-in-the-Middle (MITM) attack across the cluster mesh.
CVE-2026-75057 is a vulnerability in JetBrains IntelliJ IDEA before version 2026.1.5 where git credentials were written in plaintext to the IDE log files. This exposure could allow local users with access to the log files to obtain sensitive credentials. The issue is fixed in version 2026.1.5.
Dell ObjectScale versions prior to 4.3.0.1 have a vulnerability where sensitive information can be inserted into log files. This flaw exists in the svc_tools component and can be exploited by a low privileged local attacker to disclose sensitive information. The vulnerability is tracked as CVE-2026-59911 and has a medium severity rating with a CVSS score of 5.5. A fix is available starting from version 4.3.0.1.
CVE-2026-19483 is a vulnerability in IBM Storage Scale versions 5.2.3.0 through 5.2.3.8 and 6.0.0.0 through 6.0.1.0 where sensitive information, including the admin password, may be logged in the GUI log files. This occurs in the Storage Scale Management GUI during system deployment and upgrade processes. The vulnerability involves insertion of sensitive information into log files, potentially exposing secrets related to exceptions and administrative credentials.
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These objects can contain the X-Vault-Token request header and err.config.data request body, including submitted passwords or secret values. When a consuming application records the caught exception through console logging, structured loggers, monitoring, crash reporting, or an application performance monitoring service, the live Vault token and request secrets can be stored in plaintext and exposed to anyone with access to that output. A stolen token can permit unauthorized access to the Vault instance under the token's policies. This issue is fixed in version 0.5.2.
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files.
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnostic output. A local user with read access to the terminal session or the log directory, or anyone with access to a location where those logs are subsequently collected, could obtain those values.
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables` and `PATCH /api/v2/connections`). The audit-log masking recognised only top-level request fields, and a bulk request nests its entities two levels below, so no masking was applied to them. Any authenticated user with audit-log read access -- who need not hold Variables or Connections read at all -- could recover those secrets verbatim, and the Connection `extra` copy is stored unencrypted in the log while the connection table encrypts it. The Airflow UI's *Import Variables* action posts to this endpoint, so an ordinary operator import wrote every secret in the file to the log. This is a different code path from CVE-2026-50204: that fix shipped in 3.3.0 and covers the single-entity endpoints only, so deployments that upgraded in response to that advisory remain affected and must upgrade again. Users are advised to upgrade to apache-airflow 3.3.1 or later.
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.
Apache Ranger versions up to 2.8.0 log replayable JWT tokens, exposing sensitive authentication information in logs. This vulnerability is identified as CWE-532, involving the insertion of sensitive data into log files. The issue is fixed in version 2.9.0. The CVSS score is 6.5, indicating a medium severity risk.
CVE-2026-19363 is a medium severity vulnerability in lmammino oidc-authorizer up to version 0.4.0. It involves sensitive information exposure through log files due to logging raw Authorization header values and bearer tokens/JWTs on authentication failure. This can lead to credentials being exposed in CloudWatch Logs. The vulnerability affects the Lambda Authorizer component, specifically in the src/handler.rs and src/models.rs files. The vulnerability can be exploited remotely. A patch is available, and the product is a cloud service, so the vendor typically manages remediation. No known exploits are reported in the wild.
When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to influence the URL construction process, leading to an open redirect vulnerability. Additionally, unsanitized header values are written to application logs.
An attacker can exploit this to force redirection to arbitrary malicious domains, potentially enabling phishing attacks. Furthermore, they can inject forged entries into application logs, impacting the reliability of security logs and potentially hindering incident investigation.
CVE-2026-21766 is a medium severity vulnerability in HCL Digital Experience and Digital Experience Compose version 9.5. The default login portlet insufficiently protects credentials, which under specific configurations may cause sensitive information to be written to web server logs. This issue only affects applications using the default login portlet and does not impact other components or configurations.
ANDRITZ HIPASE-250 contains an unauthenticated HTTP endpoint that allows remote attackers to change the server's logging level and target. This vulnerability can be exploited to suppress audit logging, potentially hiding malicious activity. No authentication is required to access this critical function. The vulnerability has a medium severity score of 5.3 and does not impact confidentiality or availability but affects integrity by allowing log tampering. No patch or official remediation information is currently available.
CVE-2026-12947 is a vulnerability in IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 and 12.0.1.0 through 12.0.12.27 where sensitive information may be stored in log files accessible to local users. This could lead to unauthorized disclosure of sensitive data. The vulnerability has a high severity with a CVSS score of 7.5. No official patch or remediation guidance is currently provided by the vendor.
CVE-2026-44105 is a vulnerability in Phoenix Contact CHARX SEC-3150 devices where credentials for the local user "user-app" are inserted into log files. This exposure allows a low-privileged local attacker with access to these logs to authenticate via SSH as the limited user "user-app", potentially disrupting charging operations.
CVE-2026-59326 is a low-severity vulnerability in Spring Tools for Eclipse (version 5.2.0 and earlier) where the Spring Boot language server logs the raw value of proxy environment variables, including embedded Basic-auth credentials, at INFO level without redaction. This can lead to unintended disclosure of proxy credentials through log files, which may be accessible to other local users or attached to bug reports.
CVE-2026-14528 is a high-severity vulnerability in IBM WebSphere Application Server versions 8.5 and 9.0. It involves the insertion of sensitive information into log files, which could allow a remote attacker to obtain this sensitive data. The vulnerability is classified under CWE-532. No official patch or remediation guidance has been provided yet by IBM.