Apple macOS Tahoe 安全漏洞

Apple macOS Tahoe is the 26th major release of Apple's macOS operating system, which was released on June 10, 2025, and features a new "Liquid Glass" visual design that significantly optimizes interface aesthetics, feature integration, and cross-device collaboration. The 26th major version of the...

PT-2025-37796

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Tahoe 26 Description: A privacy issue was addressed with improved private data redaction for log entries. An application may be able to access user-sensitive data. Recommendations: Update to macOS Tahoe 26 or later...

CVE-2025-43303: Insertion of Sensitive Information into Log File

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to access sensitive user data...

About the security content of watchOS 26

About the security content of watchOS 26 This document describes the security content of watchOS 26. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available...

PT-2025-37848

Name of the Vulnerable Software and Affected Versions macOS versions prior to Tahoe 26 iOS versions prior to 26 iPadOS versions prior to 26 Description An application may be able to fingerprint a user due to improved redaction of sensitive information. Recommendations Update macOS to version Taho...

CVE-2025-43279: Exposure of Private Personal Information to an Unauthorized Actor

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Tahoe 26. An app may be able to access user-sensitive data...

GHSA-W54X-XFXG-4GXQ NeuVector process with sensitive arguments lead to leakage

Impact When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation. For example, java -cp /app ... Djavax.net.ssl.trustStorePassword= The command with the password appears in the NeuVector security event. To prevent this, NeuVector uses the...

NeuVector process with sensitive arguments lead to leakage

Impact When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation. For example, java -cp /app ... Djavax.net.ssl.trustStorePassword= The command with the password appears in the NeuVector security event. To prevent this, NeuVector uses the...

Missing Password Field Masking

Overview Affected versions of this package are vulnerable to Missing Password Field Masking due to improper handling of process command arguments containing sensitive information. An attacker can obtain confidential data by accessing security event logs where sensitive arguments, such as password...

Linux Distros Unpatched Vulnerability : CVE-2023-50291

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of th...

GHSA-3X3Q-GHCP-WHF7 Template Secret leakage in logs in Scaffolder when using `fetch:template`

A logging flaw in Backstage Scaffolder’s fetch:template action up to @backstage/plugin-scaffolder-backend 2.1.0 may write template secrets to logs. The action emitted a duplicate, pre-redaction copy of input parameters, so values provided via the secrets bag could appear in local/server logs when...

CVE-2025-55285

The CVE-2025-55285 issue affects the Backstage scaffolder-backend plugin. Before version 2.1.1, the fetch:template action could duplicate the input log path, causing some secrets passed via the {{ secrets }} bag to be written to logs instead of being redacted. Affected product: @backstage/plugin-...

CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If $ secrets.x is not passed...

PT-2025-33503 · Backstage · @Backstage/Plugin-Scaffolder-Backend

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-scaffolder-backend versions prior to 2.1.1 Description: The backend for the default Backstage software templates exhibited duplicate logging of input values in the fetch:template action within the Scaffolder. This resulted i...

Malicious code in redaction-lib-osx (npm)

The package redaction-lib-osx was found to contain malicious code...

MAL-2025-31916 Malicious code in redaction-lib-osx (npm)

The package redaction-lib-osx was found to contain malicious code...

MAL-2025-31915 Malicious code in redaction-lib (npm)

The package redaction-lib was found to contain malicious code...

Malicious code in redaction-lib (npm)

The package redaction-lib was found to contain malicious code...

CVE-2025-8862

YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend upgrading the database to a version where this information is properly redacted...

PT-2025-32542 · Yugabyte · Yugabytedb

Name of the Vulnerable Software and Affected Versions: YugabyteDB affected versions not specified Description: YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. Recommendations: Upgrade the database to a version where...