CVE-2026-97181: Exposure of Sensitive System Information to an Unauthorized Control Sphere

GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs...

CVE-2026-14442: Insertion of Sensitive Information into Log File

An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters including external server passwords and...

PT-2026-97725

Name of the Vulnerable Software and Affected Versions GPM LIGHT affected versions not specified Description Unauthenticated remote attackers can directly access system logs, leading to sensitive data exposure. Recommendations At the moment, there is no information about a newer version that...

CVE-2026-82716: Insertion of Sensitive Information into Log File

The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diagnostic logs generated during the support process. These logs remain accessible on removable storage after the support operation has completed. An unauthenticated attacker with...

PT-2026-98254

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 3.0.1a Description Improper handling of sensitive data during the creation and modification of IPsec policies causes pre-shared keys to be recorded in application logs. Users with read access to system log file...

CVE-2026-82372: Insertion of Sensitive Information into Log File

Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the...

PT-2026-98295

Name of the Vulnerable Software and Affected Versions SANnav affected versions not specified Description An information exposure issue exists in the job scheduling component. When scheduled support save jobs or related operational tasks are executed, sensitive parameters such as external server...

PT-2026-97837

Name of the Vulnerable Software and Affected Versions IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.8 Description An authenticated administrator can perform path traversal via the Admin API log-download endpoint GET /v1/admin/logs/file. The issue occurs because the path confinement chec...

PT-2026-97717

Name of the Vulnerable Software and Affected Versions WPeMatico RSS Feed Fetcher versions prior to 2.8.26 Description The plugin fails to verify ownership or authorization before returning a campaign's stored configuration and run log. This allows users with contributor-level access and above to...

PT-2026-98279

Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The firmware includes sensitive configuration information, such as WiFi credentials, within diagnostic logs created during the support process. These logs persist on removable storage...

automation-controller: automation-controller: client IP spoofing in audit/access logs via unrestricted X-Forwarded-For trust

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

automation-controller: automation-controller: client IP spoofing in audit/access logs via unrestricted X-Forwarded-For trust

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

CVE-2026-84718 Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

CVE-2026-84718 Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

CVE-2026-95815

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation...

CVE-2026-95815 OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation...

CVE-2026-95815 OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation...

CVE-2026-95815 OpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation...

CVE-2026-95815

Versions of OpenClaw iOS prior to 2026.8.11 are vulnerable to credential exposure due to the application logging complete agent deep-link URLs to unified logs as public diagnostic data. These logs contain persistent bearer keys , which an attacker can recover from diagnostic archives to replay in...

PT-2026-96725

The MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/misp install.log and a named pipe FIFO at /var/log/misp install.log.pipe to capture all installer output. The log captures highly sensitive data including the generated admin password,...