CVE-2026-17215 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information due to verbose error messages that reveal more system details than necessary. This information disclosure could aid an attacker in understanding the environment.
CVE-2026-17114 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to obtain sensitive information and cause a denial of service by triggering error messages that expose sensitive data.
IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 contain a vulnerability where verbose error messages may disclose sensitive information to remote attackers. This issue is classified under CWE-209, indicating that error messages reveal information that could aid an attacker. The vulnerability has a medium severity rating with a CVSS score of 5.3.
Apache Juneau versions prior to 9.2.1 have a vulnerability where error responses expose internal exception class names and messages to remote clients. This occurs through the 'Thrown' response header and may also include internal exception messages in the error body, even if stack-trace rendering is disabled. This information disclosure reveals implementation details that could aid attackers. The issue is fixed in version 9.2.1.
A flaw was found in ansible-core. When a task marked `no_log: true` fails, the task result is censored before being emitted, but the `exception` field is retained because it is present in the PRESERVE allow-list in lib/ansible/_internal/_task.py, and the default stdout callback prints it through CallbackBase._handle_exception. As a result, sensitive values the operator explicitly asked to hide can be disclosed: module argument-validation errors echo the argument value, templating errors print an Origin source snippet (the failing line plus the two preceding lines of the variables file, exposing neighbouring secrets from an -e @secrets.yml file), and fail/assert messages are printed in full. Secret material supplied as extra variables or variables files can therefore leak to terminal output, CI logs, and the stdout logs of any automation wrapping ansible-playbook, even though every task touching the secrets is marked no_log: true. This is a regression introduced with the ansible-core 2.19 data-tagging/templating rework; the behaviour does not occur on 2.16, where the error text is correctly censored.
IBM Db2 Genius Hub versions 1.1.2 through 1.1.5 contain a vulnerability where error messages expose sensitive internal implementation details. This information disclosure could be exploited by a remote authenticated attacker to gain sensitive information. The vulnerability is classified under CWE-209 and has a medium severity with a CVSS score of 4.3.
CVE-2026-91163 is a vulnerability in warpgate, an open source SSH, HTTPS, and MySQL bastion host for Linux. Prior to version 0.29.0, the Kubernetes protocol listener improperly handles authentication failures by returning detailed internal error messages, including ASN.1/DER parser diagnostics and database errors, in HTTP 500 responses. These error messages are exposed to unauthenticated network clients and are not logged by the gateway, potentially leaking sensitive internal diagnostic information. The issue is fixed in version 0.29.0.
The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise without their expected context, trigger a fatal error, and return a stack trace that discloses the server's absolute filesystem paths to unauthenticated users.
Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claim_pattern names and regular expressions in its PermissionDenied errors, which Exchange returned verbatim. Exchange also selected the GitHub App installation before checking the token, so errors from resolving the policy's app or app_pattern pin were returned to callers the policy does not trust. An attacker who holds any validly signed OIDC token, such as a GitHub Actions token from a repository they own, and who knows or guesses a target owner/repo and identity name can read that policy's matching rules, even when the policy is stored in a private repository. These rules often name internal repositories, branches, environments or cloud account identifiers. The issue does not allow minting tokens or bypassing a trust policy. This issue is fixed in 0.11.2.
jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP responses. `lib/servers/base.ts` attaches outbound request headers on upstream non-success responses and schema-validation failures; the public `extras` field in `lib/errors/FetchError.ts` remains enumerable and is emitted by JSON serialization. These headers include the internal Radarr/Sonarr `X-Api-Key` and custom connector headers such as `CF-Access-Client-Secret`. `lib/redact.ts` redacts logs and spans but not this response path. Any client with the shared peer API key, plus Cloudflare Access credentials if required by the deployment, can force an error without a race or user interaction. `GET /peer/items/:id` and `GET /servers/health` can expose the internal media-server key, while `GET /torznab/download/:id` can expose another peer's key and Cloudflare Access secrets. The /peer/search and /items routes catch these errors and are not affected. Disclosed internal keys grant full administrative control of the corresponding Radarr/Sonarr instance, crossing the intended boundary between friends' shared peer access and private backend credentials. This issue is fixed in version 0.1.0.
HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional conditions. This could allow an attacker to obtain sensitive technical information, including stack traces, system details, or internal paths, potentially facilitating further attacks.
CVE-2026-101259 is a vulnerability in the Apache Camel CoAP component affecting versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.2. It allows generation of error messages containing sensitive information such as class names, file paths, hostnames, and connection details in the payload of 5.00 Internal Server Error responses. This occurs when the CoAP consumer fails to build its response after route completion, exposing internal deployment details to remote clients. The issue is fixed in Apache Camel versions 4.18.5, 4.22.2, and 4.23.0. Users are advised to upgrade to these versions or apply recommended mitigations if immediate upgrade is not possible.
KNIME Business Hub versions prior to 1.18.5 contain an information disclosure vulnerability due to overly informative error messages in the catalog functionality. Authenticated remote attackers who know a workflow ID may view workflow names. No workaround is available. The issue is fixed in versions 1.18.4 and 1.18.5.
A vulnerability in webpack-dev-server versions 5.1.0 up to but not including 5.2.7, and 6.0.0 up to but not including 6.1.0, allows unauthenticated attackers to cause the server to disclose sensitive information via error messages. This occurs because the open-editor endpoint improperly validates the Host header, leading to an exception that reveals absolute filesystem paths, module locations, and source line numbers in HTTP 500 responses. The server continues running without denial of service. The issue is fixed in versions 5.2.7 and 6.1.0.
CVE-2026-112947 is a path traversal vulnerability in the Vite development server that allows an attacker to retrieve the first 4 bytes of arbitrary files on disk by sending a request with the query parameter '?vite-wasm-instance'. This occurs because the internal Wasm plugin's load hook reads files without applying server.fs access restrictions. The vulnerability affects Vite versions >=0.2.8 <1.1.0, >=8.2.0 <8.2.4, and >=8.3.0 <8.3.3. It only impacts applications that expose the Vite dev server to the network, run on Node.js or Deno, and have sensitive information in the first 4 bytes of a file. The issue is fixed in versions 1.1.0, 8.2.4, and 8.3.3.
IBM Concert versions 1.0 through 3.0.0 contain a vulnerability where error messages disclose sensitive schema suggestion information. This information disclosure flaw is classified under CWE-209. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity level. No public exploits or known active exploitation have been reported. No patch or remediation details are provided in the available data.
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
When a route behind a gRPC consumer failed, the exception's message was placed into the gRPC status description. Unlike the status cause, which stays local to the server, the description is transmitted to the calling client, so an external caller able to provoke a failure could read the internal error message. What that discloses depends on the exception, and in practice includes class and package names, paths, host names and connection detail carried in messages. This is the gRPC member of the same unmuted-consumer-exception family as the knative, mina and CXF advisories published alongside it.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. A muteException consumer option, defaulting to true, puts a generic description in the status instead of the route exception's message. Set muteException=false to restore the previous output. For deployments that cannot upgrade immediately, map failures onto an explicit status in an onException handler so the framework never copies the exception message into the description.
Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component.
This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1.
When a route behind a CXF SOAP consumer failed with an exception the service contract does not declare, the exception was described back to the SOAP client in the fault: CXF copies the message into the SOAP faultstring, and can be configured to place the stack trace in the fault detail. An external caller able to provoke a failure could therefore read internal detail about the deployment - class and package names, and whatever the exception message carries. Declared faults, annotated @WebFault, are a different matter: those are part of the published contract that clients are written against, and suppressing them would break the service rather than protect anything.
Upgrade to Apache Camel 4.23.0, which fixes the issue. Users on the 4.18.x LTS releases stream should upgrade to 4.18.5. Users on the 4.22.x LTS releases stream should upgrade to 4.22.1. A muteException consumer option, defaulting to true, replaces an undeclared route failure with a generic fault carrying no class name, message or stack trace. Faults the contract declares are reported exactly as before. Set muteException=false to restore the previous output. For deployments that cannot upgrade immediately, declare the exceptions the service is allowed to report and map every other failure onto one of them in an onException handler, so no undeclared exception reaches the fault.
CVE-2026-85246 is a vulnerability in the Apache Camel Mina component where error messages containing sensitive information are sent back to remote peers. This occurs when processing an exchange fails, causing the Mina consumer to send the exception details, including class names, messages, and nested causes, over the network. This can expose internal deployment details such as class/package names, paths, hostnames, and connection information. The issue affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. The vulnerability is fixed in versions 4.18.5 and 4.22.1 by introducing a muteException option that suppresses sensitive exception details in replies. For those unable to upgrade immediately, a workaround involves adding an onException handler to prevent exception details from being sent to peers.
CVE-2026-84180 is a vulnerability in the Apache Camel Knative component where error messages generated on consumer-side failures include sensitive information such as exception class names, messages, stack traces, and internal deployment details. This information disclosure can aid attackers in crafting targeted attacks. The issue affects Apache Camel versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1. Fixed versions are 4.18.5 and 4.22.1, which introduce a muteException option defaulting to true to suppress exception details in responses. Users unable to upgrade immediately can mitigate by adding an onException handler to control response bodies.