CVE-2026-79551-Tenda

CVE-2026-79551 Tenda 하드코딩된 TLS 개인 키 CNVD ID: CNVD-2026-25884 제조사: Tenda Technology Co., Ltd. 제품: NVR4H 네트워크 비디오 레코더 하드웨어 버전 CH3V2.1 펌웨어: V27.5.58.6 분류: CWE-321 — 하드코딩된 암호화 키 사용 개요 NVR4H 펌웨어는 읽기 전용 user-x.squashfs 파티션/opt/app/에 마운트됨에 ECDSA 키 쌍을 저장합니다. 개인 키는 /etc/privkey.pem에, 이와 일치하는 자체 서명 인증서는...

Information Exposure

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Information Exposure via the Certificates.get and Certificates.listing API commands, which return the sslkeyfile field containing raw PEM TLS private-key content in JSON responses. An...

CVE-2026-81320

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

EUVD-2026-78276

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CVE-2026-81320

hawtio-operator (used in the OpenShift ecosystem) leaks the TLS private key in PEM format when a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher . The entire Route object is serialized to JSON and written to the operator's standard output, which is typic...

CVE-2026-81320 Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CVE-2026-81320

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CVE-2026-81320: Insertion of Sensitive Information into Log File

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

PT-2026-91863

A flaw was found in hawtio-operator. When a custom Route TLS secret is configured and the operator runs at debug log level 1 or higher, the entire Route object — including the TLS private key in PEM format — is serialized to JSON and written to the operator's standard output. Operator logs are...

CVE-2026-86781

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...

EUVD-2026-75970

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...

CVE-2026-86781

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin, in versions before 4.7.40 , is vulnerable to unauthorized data disclosure. The root cause is a lack of capability or nonce checks on a certificate-file download routine that executes early in the WordPress admin request l...

CVE-2026-86781 SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...

CVE-2026-86781 SSL Zen < 4.7.40 - Subscriber+ TLS Private Key Disclosure

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...

PT-2026-89787

The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40 does not perform capability or nonce checks on a certificate-file download routine that runs early in the WordPress admin request lifecycle, allowing any authenticated user, including Subscribers, to download...

Insertion of Sensitive Information into Log File

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File incomplete sanitization of TLS private keys in log output. An attacker can obtain sensitive cryptographic material by accessing logs where the private ke...

CVE-2026-88883 Renovate before 44.14.4 TLS Private Key Log Sanitisation

Renovate is an automated dependency update tool. In versions before 44.14.4 and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0, log sanitisation for TLS private keys used for Mutual TLS was incomplete. While the value of...

CVE-2026-88883

Renovate versions before 44.14.4 (Mend Renovate CE/EE images before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0) contain an incomplete log sanitisation flaw for TLS private keys used in Mutual TLS. The value of hostRules[].httpsPrivateKey was redacted in its own field but no...

EUVD-2026-75433

Renovate is an automated dependency update tool. In versions before 44.14.4 and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0, log sanitisation for TLS private keys used for Mutual TLS was incomplete. While the value of...

CVE-2026-88883 Renovate before 44.14.4 TLS Private Key Log Sanitisation

Renovate is an automated dependency update tool. In versions before 44.14.4 and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0, log sanitisation for TLS private keys used for Mutual TLS was incomplete. While the value of...