EUVD-2026-94069

Backstage has sensitive information exposure in scaffolder task logs...

Backstage has sensitive information exposure in scaffolder task logs

Impact An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. Patches Patched in...

Important: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.4.7

Logging for Red Hat OpenShift - 6.4.7 Red Hat OpenShift Logging 6.4.7 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs...

regipy

regipy ⚠️ Breaking Changes in v6.0.0 Version 6.0.0 includes significant modernization changes: Python 3.9+ required - Dropped support for Python 3.6, 3.7, and 3.8 attrs library removed - Data classes now use Python's built-in dataclasses module If your code imports internal classes Cell,...

CVE-2026-105241

A flaw was found in Apache log4net. An attacker who can supply data that is recorded in system logs can submit unencodable Unicode characters, triggering an encoding error in the SmtpPickupDirAppender component. When this failure occurs, the application discards all buffered log messages in the...

CVE-2026-34038

CVE-2026-34038: Coolify における認証済みリモートコマンドインジェクション このリポジトリは、Coolify の重大なコマンドインジェクション脆弱性 CVE-2026-34038 に関するドキュメントと分析を提供します。 概要 Coolify における認証済みリモートコマンドインジェクション脆弱性 CWE-78 により、アプリケーションの "write" 権限を持つユーザーが、ビルド環境が Docker ソケットを分離している場合でも、デプロイメントログを介して リモートコード実行 RCE を達成し、機密環境変数 例: データベース認証情報、API キー を 流出...

CVE-2026-106499

A flaw was found in the Backstage Scaffolder backend. In environments configured with default environment secrets, an authenticated attacker with permissions to create or modify templates can cause secret-derived values to be recorded in task logs. This issue leads to information disclosure,...

CVE-2026-106504

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive...

CVE-2026-106499

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or...

CVE-2026-106504 Backstage: Sensitive information exposure in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive...

CVE-2026-106504 Backstage: Sensitive information exposure in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive...

CVE-2026-106504

The Backstage framework is vulnerable in the @backstage/plugin-scaffolder-backend package prior to version 4.1.0 . The root cause is sensitive information exposure within scaffolder task logs. An authenticated user capable of creating and reading tasks can observe sensitive values if a deployment...

CVE-2026-106504 Backstage: Sensitive information exposure in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive...

CVE-2026-106499 Backstage: Secret-derived values may be exposed in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or...

CVE-2026-106499 Backstage: Secret-derived values may be exposed in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or...

CVE-2026-106499

The Backstage framework, specifically the @backstage/plugin-scaffolder-backend package, is vulnerable in versions prior to 4.1.0 . The issue allows secret-derived values to be exposed in Scaffolder task logs when deployments configure sensitive scaffolder.defaultEnvironment.secrets and permit una...

CVE-2026-106499 Backstage: Secret-derived values may be exposed in scaffolder task logs

Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose secret-derived values in Scaffolder task logs. Deployments that configure sensitive scaffolder.defaultEnvironment.secrets and allow an attacker to create or...

EUVD-2026-93867

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A...

Sensitive Data Leakage

Snowflake drivers are vulnerable to Insertion of Sensitive Data Leakage. The vulnerability is due to sensitive data such as authentication tokens, encryption keys, pre-signed cloud-storage URLs, and SAML assertions being written to diagnostic logs, which allows an attacker with read access to the...

evtx-baseline

evtx-baseline サンプルソフトウェアのインストールと基本的なユーザー操作を含む、良性ソフトウェア（goodware）の evtx ログの例をホストするリポジトリです。 提供 win10-client.tgz：@phantinuss による提供 win11-client.tgz：@frack113 による提供 win7-x86.tgz：@pH-T による提供 win2022-evtx.tgz：@Neo23x0 による提供 win2022-ad.tgz：@frack113 による提供 win2022-0-20348-azure.tgz：@Neo23x0 による提供...