CVE-2026-20708

Insertion of sensitive information into log file in the subsystem for the IntelR AMT and IntelR Standard Manageability may allow an information disclosure. Network adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur v...

CVE-2026-62728 Windows Common Log File System Driver Elevation of Privilege Vulnerability

...

CVE-2026-20708

Insertion of sensitive information into log file in the subsystem for the IntelR AMT and IntelR Standard Manageability may allow an information disclosure. Network adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur v...

EUVD-2026-56473

Insertion of sensitive information into log file in the subsystem for the IntelR AMT and IntelR Standard Manageability may allow an information disclosure. Network adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur v...

CVE-2026-20708

CVE-2026-20708 affects the Intel AMT and Intel Standard Manageability subsystem. The issue is described as insertion of sensitive information into a log file, enabling information disclosure. The entry indicates a network-adjacent attacker with high privileges and high attack complexity could cau...

CVE-2026-20708

Insertion of sensitive information into log file in the subsystem for the IntelR AMT and IntelR Standard Manageability may allow an information disclosure. Network adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur v...

Security Bulletin: The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher

Summary The following vulnerabilities, which can affect IBM Storage Scale and the Management GUI and could provide weaker-than-expected security, are now fixed in Storage Scale 5.2.3.9 or higher and 6.0.1.1 or higher. CVE-2026-19483, CVE-2026-13460 Vulnerability Details CVEID:CVE-2026-19483...

CVE-2026-49834

A flaw was found in sigstore-go, a Go library for Sigstore signing and verification. This vulnerability allows a single compromised transparency log or Certificate Transparency CT log to bypass the multi-log threshold requirements. An attacker could exploit this by compromising a single log,...

CVE-2026-20708: Insertion of Sensitive Information into Log File

Insertion of sensitive information into log file in the subsystem for the IntelR AMT and IntelR Standard Manageability may allow an information disclosure. Network adversary with a privileged user combined with a high complexity attack may enable data exposure. This result may potentially occur v...

CVE-2026-71845: Insertion of Sensitive Information into Log File

A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...

PT-2026-70871

Name of the Vulnerable Software and Affected Versions insights-client affected versions not specified Description A flaw exists in the setDefault function that logs the value of every environment variable it processes. This includes CCX TOKEN, a bearer credential used in disconnected cluster...

PT-2026-70936

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special...

CVE-2026-62728: Time-of-check Time-of-use (TOCTOU) Race Condition

Time-of-check time-of-use toctou race condition in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally...

PT-2026-71960

Name of the Vulnerable Software and Affected Versions OutSystems Service Center versions prior to 11.41.2 OutSystems Lifetime versions prior to 11.28.2.3955 Description OutSystems Service Center is subject to a DOM-based Cross-Site Scripting XSS issue, where a low-privileged attacker can execute...

WordPress Download Monitor has an authorization vulnerability

WordPress Download Monitor is a powerful free plugin designed specifically for WordPress, used to manage, track, and analyze website file downloads. It supports version control, permission restrictions, and detailed logging. WordPress Download Monitor has an authorization vulnerability that arise...

PT-2026-70935

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 2.0.0-rc6 Description Kestra serves Micronaut management endpoints on port 8081 without authentication, bypassing the Basic Auth protection applied to the /api/v1/ endpoints on port 8080. This allows unauthenticated...

CVE-2026-18702: Improper Privilege Management

An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring...

PT-2026-70279

Name of the Vulnerable Software and Affected Versions IntelR AMT and IntelR Standard Manageability affected versions not specified Description An issue in the subsystem for IntelR AMT and IntelR Standard Manageability allows the insertion of sensitive information into log files, which may lead to...

CVE-2026-73245: Missing Authentication for Critical Function

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0-rc6, Kestra's cli/src/main/resources/application.yml serves Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/ on port 8080, allowing unauthenticated GET /env...

Apache Tomcat 9.0.13 < 9.0.117 Insertion of Sensitive Information Vulnerability

The version of Tomcat installed on the remote host is 9.0.13 prior to 9.0.117. It is, therefore, affected by a vulnerability as referenced in the fixedinapachetomcat9.0.117security-9 advisory. - Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering...