CVE-2026-102289

zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, --gh-token, --github-token, or...

CVE-2026-90588 Out-of-bounds read in Zephyr HTTP client debug logging of response header fields

The HTTP client's debug helper printheaderfield in subsys/net/lib/http/httpclient.c formatted an httpparser data-callback slice with a %s conversion: snprintkoutput, len + 1, "%s", str. The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not...

CVE-2026-90588 Out-of-bounds read in Zephyr HTTP client debug logging of response header fields

The HTTP client's debug helper printheaderfield in subsys/net/lib/http/httpclient.c formatted an httpparser data-callback slice with a %s conversion: snprintkoutput, len + 1, "%s", str. The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not...

zizmor: Debug logging prints available GitHub credentials in cleartext

Summary zizmor 1.27.0 exposes GitHub access tokens in cleartext when debug-level logging is enabled. Tokens supplied via environment variables GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, or the corresponding command-line options --gh-token, --github-token, --zizmor-github-token are included in the...

GHSA-F42P-WJW5-97QH zizmor: Debug logging prints available GitHub credentials in cleartext

Summary zizmor 1.27.0 exposes GitHub access tokens in cleartext when debug-level logging is enabled. Tokens supplied via environment variables GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, or the corresponding command-line options --gh-token, --github-token, --zizmor-github-token are included in the...

EUVD-2026-120506

zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, --gh-token, --github-token, or...

CVE-2026-102289 zizmor: Debug logging prints available GitHub credentials in cleartext

zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, --gh-token, --github-token, or...

CVE-2026-102289

The static analysis tool zizmor version 1.27.0 contains a vulnerability where debug logging serializes the application configuration, causing GitHub credentials to be written to stderr in cleartext. This occurs when tokens are supplied via environment variables (e.g., GH_TOKEN, GITHUB_TOKEN, ZIZM...

CVE-2026-102289 zizmor: Debug logging prints available GitHub credentials in cleartext

zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, --gh-token, --github-token, or...

PT-2026-141142

Name of the Vulnerable Software and Affected Versions zizmor version 1.27.0 Description Debug logging serializes the parsed application configuration, causing GitHub credentials to be written to stderr in cleartext. This occurs when tokens are supplied via environment variables GH TOKEN, GITHUB...

CVE-2026-102289: zizmorcore zizmor: zizmor is a static analysis tool for CI/CD systems

zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GHTOKEN, GITHUBTOKEN, ZIZMORGITHUBTOKEN, --gh-token, --github-token, or...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in imspcuirq debug logging The debug logging in imspcuirq unconditionally prints data from pcu-urbinbuf. However, if the interrupt was triggered for pcu-urbctrl, the actual data resides in...

CVE-2026-108089

UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...

CVE-2026-108089

UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...

EUVD-2026-104914

UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...

Siemens SIMATIC S7-1500 TM MFP Plaintext Storage of a Password (CVE-2026-23303)

In the Linux kernel, the following vulnerability has been resolved: smb: client: Don't log plaintext credentials in cifssetcifscreds When debug logging is enabled, cifssetcifscreds logs the key payload and exposes the plaintext username and password. Remove the debug log to avoid exposing...

PT-2026-118327

UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: smb: client: Do not log plaintext credentials in cifssetcifscreds When debug logging is enabled, cifssetcifscreds logs the key payload and exposes the plaintext username and password. Disable debug logging to prevent credential...

Astra Linux – vulnerability in Ansible

In Ansible, all versions of Ansible Engine up to ansible-engine 2.8.5, ansible-engine 2.7.13, and ansible-engine 2.6.19 logged at the DEBUG level. This led to credential leakage when plugins utilized libraries that log credentials at the DEBUG level. This flaw does not affect Ansible modules, as...

PT-2026-105153

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG DEBUG"shutting down Shovel 'ts', ... Shovel state: tp", Name, State formats the entire state map. The 'uris' field holds plaintext URIs after credentials obfuscation:decrypt called in...