CVE-2026-54711

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1...

EUVD-2026-108916

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This issue has been patched in version 2.7.1...

Aiven Open PGHoard log information leakage vulnerability

Versions of Aiven Open PGHoard prior to 2.7.1 contain a log information leakage vulnerability. This vulnerability arises from logging database connection details containing usernames and passwords at the debug level when using .pgpass files, potentially leading to credential exposure...

CVE-2026-19600 Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate...

CVE-2026-19600 Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate...

CVE-2026-19600

Mattermost versions 11.9.x <= 11.9.1 , 11.8.x <= 11.8.5 , 11.7.x <= 11.7.10 , and 11.10.x

CVE-2026-19600 Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate...

EUVD-2026-102744

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate...

CVE-2026-19600: Insertion of Sensitive Information into Log File

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate...

PT-2026-115515

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to sanitize authentication tokens before writing them to server log entries, which allows an attacker with access to server logs to obtain valid session tokens or OAuth access tokens and impersonate...

Mattermost log information leakage vulnerability

Mattermost versions 11.9.1 and earlier of 11.9.x series, 11.8.5 and earlier of 11.8.x series, 11.7.10 and earlier of 11.7.x series, and 11.10.1 and earlier of 11.10.x series have a vulnerability related to log information leakage. This vulnerability arises from the failure to clear the...

Astra Linux – Vulnerability in cups

OpenPrinting CUPS is an open-source printing system. In versions 2.4.2 and earlier, a heap buffer overflow vulnerability existed, which allowed a remote attacker to launch a Denial-of-Service DoS attack. This vulnerability was present in the formatlogline function. Exploitation of this...

PT-2026-67003

Name of the Vulnerable Software and Affected Versions affected versions not specified Description The DHCPv4 client helper function net dhcpv4 msg type name in subsys/net/lib/dhcpv4/dhcpv4.c contains a faulty bounds check when indexing a static 8-element name table. The check incorrectly uses...

sssd security update

2.9.8-4.0.1.el98.1 - Restore default debug level for ssscache Orabug: 32810448 2.9.8-5 - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Resolves: RHEL-192070 CVE-2026-14476 sssd: path...

PT-2026-59509

Impact When using .pgpass, database connection information including the username and password will be logged at the debug level. Patches Upgrade to version 2.7.1 or greater. Workarounds Filter out debug-level logs. References This issue was discovered by BugCrowd user DRAKOKORIAN...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the logging process when the DEBUG loglevel is enabled. An attacker can access sensitive information, such as API keys or LLM response data, by reading log files generated under these conditions. This is only...

CVE-2026-54711

When using .pgpass, database connection information including the username and password will be logged at the debug level...

PGHoard: Password written to debug log

Impact When using .pgpass, database connection information including the username and password will be logged at the debug level. Patches Upgrade to version 2.7.1 or greater. Workarounds Filter out debug-level logs. References This issue was discovered by BugCrowd user DRAKOKORIAN...

PT-2026-50728

Name of the Vulnerable Software and Affected Versions affected versions not specified Description Database connection information, including the username and password, is logged at the debug level when using .pgpass. Recommendations Upgrade to version 2.7.1 or greater. Filter out debug-level logs...

Tigera Calico security vulnerabilities

Tigera Calico is an open-source network security solution developed by the American company Tigera, designed for container, virtual machine, and host workload scenarios. Tigera Calico has a security vulnerability that arises from printing the complete connection configuration structure when calle...