CWE-532: Sensitive Data in Logs vulnerabilities

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message helper that strips object-repr memory addresses from error messages before they reach the client, is incomplete: several response paths echo str(exc) directly to clients without calling sanitize_message. The unsanitized sites include the Anthropic API router in vllm/entrypoints/anthropic/api_router.py (the POST /v1/messages and POST /v1/messages/count_tokens handlers), the Server-Sent Events streaming converter in vllm/entrypoints/anthropic/serving.py, and the realtime speech-to-text WebSocket in vllm/entrypoints/speech_to_text/realtime/connection.py. These paths catch the exception inside the route coroutine and construct the JSONResponse themselves, bypassing the sanitizing global FastAPI exception handler, and WebSocket frames do not traverse that handler chain at all. Using the same primitive as the parent issue, an unauthenticated attacker can send malformed image bytes through the Anthropic Messages API image content parts so that PIL.Image.open raises an UnidentifiedImageError whose message contains the BytesIO object repr, leaking the heap memory address verbatim in the error.message field of the response body. This vulnerability is fixed in 0.23.1rc0.

CVE-2026-0267 is an information exposure vulnerability in the Palo Alto Networks GlobalProtect app for macOS. It allows a local user to discover the configured passcodes used to disable, disconnect, or uninstall the app. With knowledge of these passcodes, the user can bypass normal configuration restrictions and perform these actions. The vulnerability affects versions 6.2.0 and 6.3.0 of the GlobalProtect app. The CVSS score is 4.4, indicating a medium severity level. No official patch or remediation guidance has been provided yet by the vendor. There are no known exploits in the wild at this time.

MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.

CVE-2026-9751 is a vulnerability in MongoDB Server where the ldapQueryPassword parameter, when set via the runtime setParameter command, is logged in plain text to the mongod.log file. This exposure of sensitive information in logs can lead to unauthorized disclosure of LDAP passwords. The issue affects MongoDB Server versions 7.0.0, 8.0.0, 8.2.0, and 8.3.0. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.8. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

A vulnerability in fabric-chaincode-java versions 2.3.1 up to but not including 2.5.10 causes the TLS private key password to be logged in plaintext at INFO level when chaincode is deployed in chaincode-as-a-service mode with TLS enabled. This exposure could allow an attacker with access to the logs to recover the password and potentially impersonate the chaincode server if they also obtain the TLS private key. The issue is fixed in version 2.5.10.

Acer Connect M6E 5G Portable WiFi Router logs sensitive information including unencrypted SMTP server authentication passwords and employee corporate identification data in system log files. This vulnerability can lead to exposure of confidential credentials and personal data if logs are accessed by unauthorized parties. The issue is classified under CWE-532, indicating insertion of sensitive information into log files. No patch or official remediation has been confirmed at this time.

When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems. This issue has been patched in version 0.9.0.

A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local OS privileges to the main server to access the Server Admin credentials. A third party hired by Genetec found the issue. There is currently no evidence of active exploitation. This vulnerability is associated with specific installation package builds rather than the product version identifier alone. Certain versions (including 5.10.4.0, 5.11.3.0, 5.12.2.0 and 5.13.3.0) were released with both vulnerable and remediated installation packages under the same version number. Consequently, version-based comparison alone is insufficient to determine exposure. Only installations performed using vulnerable builds are affected. Remediated builds can be distinguished using verified installation package hashes. For the complete list of fixed build hashes, refer to the security advisory section.

The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.

A vulnerability in Tigera Calico occurs when configured with the Azure IPAM plugin. The Calico CNI binary modifies the CNI configuration to add subnet information and then logs the entire configuration, including sensitive Kubernetes authentication tokens, at INFO level to a local log file on each pod addition or deletion. This exposes ServiceAccount tokens and related credentials in plaintext to any user with read access to the log file, potentially granting cluster-wide Calico networking admin privileges.

CVE-2026-6720 is a vulnerability in Tigera Calico's calicoctl tool where enabling verbose logging (--log-level=info or debug) causes sensitive credentials to be printed to stderr. These credentials include kubeconfig bearer tokens, Kubernetes API tokens, etcd passwords, and PEM-encoded client certificates. The default log level is panic, so this exposure only occurs when verbose logging is explicitly enabled.

CVE-2026-41184 is a vulnerability in Tigera Calico where the install-cni init container logs the rendered CNI configuration including a substituted Kubernetes ServiceAccount bearer token. This token is exposed in logs accessible to any authenticated user with pods/log permission in the calico-node namespace. The exposed token grants patch privileges on pods/status, enabling potential annotation-based attacks on cluster workloads. The default kubeconfig-based authentication is not affected. No patch or official remediation is currently confirmed.

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.0 stores potentially sensitive information in log files that could be read by a local user.

IBM MQ Operator SC2: v3.2.0 through 3.2.23CD:  v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.5.3, v3.6.0 - v3.6.4, v3.7.0 - v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9.1LTS: v2.0.0 - 2.0.29 and IBM supplied MQ Advanced container images SC2: 9.4.0.6 through r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1, 9.4.3.0-r2, 9.4.3.1-r1 - 9.4.3.1-r3, 9.4.4.0-r1 - 9.4.4.0-r4, 9.4.4.1-r1, 9.4.5.0-r1, 9.4.5.0-r2LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2 IBM MQ stores potentially sensitive information in log files that could be read by a local user.

CVE-2025-13755 is a vulnerability in IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.4 on Linux, UNIX, and Windows platforms. The issue involves the insertion of potentially sensitive information into log files, which could be accessed by a local user.

CVE-2026-25193 is a vulnerability in Gallagher Command Centre Server version 9.40 where sensitive information, specifically Service Account credentials, may be inserted into installer log files. This issue affects installations using a custom Service Account rather than the default Network Service account. The vulnerability could lead to exposure of credentials if the log files are accessed. Gallagher has not provided an official patch or remediation level yet. The recommended mitigation is to change the Service Account password and delete any installer log files found in %programdata%\Gallagher\Command Centre. There are no known exploits in the wild at this time.

Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows Resource Leak Exposure. This issue affects Avantra: before 25.3.0.

CVE-2026-44516 is a vulnerability in the Valtimo open-source business process automation platform affecting versions from 12.4.0 up to but not including 12.33.0, and from 13.0.0 up to but not including 13.26.0. The issue arises because the LoggingRestClientCustomizer component logs full HTTP request and response bodies and headers, including sensitive information, at the ERROR log level when an error response occurs.