144 matches found
Sensitive Information Exposure
com.ritense.valtimo, web is vulnerable to sensitive information exposure. The vulnerability is due to the LoggingRestClientCustomizer automatically logging full HTTP request and response details, including headers and bodies, in error messages, which allows an attacker to access sensitive...
Valtimo: Sensitive data exposure through inbox message logging in InboxHandlingService
Summary The InboxHandlingService logs the full content of every incoming inbox message at INFO level logger.info"Received message: ", message. Inbox messages are wrappers around outbox message data, which can contain highly sensitive information such as personal data PII, citizen identifiers BSN,...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the logs and logs-stream endpoints. An attacker can access sensitive application log data by authenticating with basic user privileges, as these endpoints do not enforce privilege checks. Remediation There is n...
CVE-2026-5025 Langflow - Application Logs Exposed to All Authenticated Users
The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication 'getcurrentactiveuser' without any privilege checks e.g., 'issuperuser'...
CVE-2026-5025 Langflow - Application Logs Exposed to All Authenticated Users
The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log buffer. These endpoints only require basic authentication 'getcurrentactiveuser' without any privilege checks e.g., 'issuperuser'...
Important: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.3.4
Logging for Red Hat OpenShift - 6.3.4 Red Hat OpenShift Logging 6.3.4 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs...
CVE-2026-32598
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs log...
CVE-2026-21791
HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL...
EUVD-2026-10489
HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL...
CVE-2026-21791
HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL...
PT-2026-24198
Name of the Vulnerable Software and Affected Versions HCL Sametime for Android affected versions not specified Description HCL Sametime for Android has a flaw that leads to sensitive information disclosure. Hostnames are written into application logs and specific URLs. Recommendations At the...
CVE-2026-21786
HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs...
Gokapi has privilege escalation via incomplete API-key permission revocation on user rank demotion
Summary A privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permissions, enabling continued access to upload-request management and log viewing endpoints after the user has been...
CVE-2026-21786
HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs...
CVE-2026-21786
HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs...
CVE-2026-21786
Technical details about CVE-2026-21786 are not publicly available in the provided documents. Monitor for updates.
PT-2026-23413
HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs...
CVE-2026-25813 PlaciPy Exposes Sensitive Data via Application Logs
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to console output without masking or redaction...
CVE-2026-25813 PlaciPy Exposes Sensitive Data via Application Logs
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to console output without masking or redaction...
CVE-2026-25813 PlaciPy Exposes Sensitive Data via Application Logs
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to console output without masking or redaction...