CVE-2026-44970

dbt-mcp prior to v1.17.1 serializes and transmits the full MCP tool call arguments (including sql_query from show and vars from run/build/test) to the dbt Labs telemetry service without redaction, by default. This telemetry is enabled by default unless explicitly opted out, and a fix is available...

CVE-2026-9735

MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction...

CVE-2026-25813

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to console output without masking or redaction...