Sensitive Information Exposure

github.com/coder/coder/v2 is vulnerable to Sensitive Information Exposure. The vulnerability is due to logging of Workspace Agent manifests containing sensitive values in plaintext without sanitization, which allows an attacker with access to logs to retrieve confidential information...

CVE-2026-29061

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permission...

CVE-2026-29061

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permission...

CVE-2026-29061 Gokapi: Privilege escalation via incomplete API-key permission revocation on user rank demotion

Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a privilege escalation vulnerability in the user rank demotion logic allows a demoted user's existing API keys to retain ApiPermManageFileRequests and ApiPermManageLogs permission...

PT-2026-23605

Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.2.3 Description Gokapi is a self-hosted file sharing server that includes automatic expiration and encryption support. A flaw in the user rank demotion logic allows a demoted user’s existing API keys to retain...

CVE-2026-27900 Terraform Provider Debug Logs Vulnerable to Sensitive Information Exposure

The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackScript content, and object storage data in debug logs without redaction. Provider debug logging is not enabled by default. This issue is exposed when debug/provider logs are...

EUVD-2025-207547

Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, values of those variables appeared in the audit log and were...

Tanium Trends 安全漏洞

Tanium Trends is a data visualization and historical analysis module provided by the American company Tanium. Tanium Trends has a security vulnerability, which stems from the insertion of sensitive information into log files. This vulnerability may allow attackers with access to the logs of the...

Tanium Interact和Tanium TDS 安全漏洞

Tanium Interact and Tanium TDS are both products of the American company Tanium. Tanium Interact is a query and interaction component for terminal management platforms. Tanium TDS is a cache library component for terminal data. Both Tanium Interact and Tanium TDS have security vulnerabilities...

CVE-2019-25376

OPNsense 19.1 is affected by a reflected cross-site scripting (XSS) vulnerability in the proxy endpoint. The ignoreLogACL parameter can be exploited via crafted POST payloads to inject JavaScript, enabling an unauthenticated attacker to execute scripts in users’ browsers. Root cause: improper han...

WordPress plugin Activity Log for WordPress 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that extends the...

GitLab 13.2 < 18.4.5 / 18.5 < 18.5.3 / 18.6 < 18.6.1 (CVE-2025-13611)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user with access to...

CVE-2026-22922

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this...

AVEVA PI to CONNECT Agent 日志信息泄露漏洞

AVEVA PI to CONNECT Agent is a data transfer component developed by the British company AVEVA. AVEVA PI to CONNECT Agent has a vulnerability related to log information leakage. This vulnerability arises from attackers who have access to event log reading capabilities, allowing them to obtain...

CVE-2026-22922 Apache Airflow: Airflow externalLogUrl Permission Bypass

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with custom permissions limited to task access to view task logs without having task log access. Users are recommended to upgrade to Apache Airflow 3.1.7 or later, which resolves this...

PT-2026-7102

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 3.1.0 through 3.1.6 Description An authorization flaw exists in Apache Airflow that could allow an authenticated user with limited task permissions to view task logs without proper authorization. The issue affects syste...

CVE-2026-1622

A flaw was found in Neo4j. The obfuscateliterals option in the query logs fails to extend redaction to error messages. When a query triggers an error, unredacted data, potentially containing sensitive literals, are exposed in the logs. This issue allows an attacker with access to the local log...

CVE-2025-12679 Plain text pbe key visible in audit log during Brocade SANnav migration from 2.4.0a to 3.0.0

A vulnerability in Brocade SANnav before 2.4.0b prints the Password-Based Encryption PBE key in plaintext in the system audit log file. The vulnerability could allow a remote authenticated attacker with access to the audit logs to access the pbe key. Note: The vulnerability is only triggered duri...

CVE-2026-25069

CVE-2026-25069 concerns SunFounder Pironman Dashboard (pm_dashboard)

CVE-2025-55704

Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of the affected product and obtain sensitive information within the logs...