PT-2026-108002

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obtain sensitive information due to improper authorization...

CVE-2026-103371

Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

EUVD-2026-94553

Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3. Users are recommended to upgrade to version 2.0.3, which fixes the issue...

Backstage has a sensitive information disclosure in Kubernetes resource queries

Impact An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources...

EUVD-2026-94059

Backstage: Sensitive information exposure in Scaffolder...

Backstage: Sensitive information exposure in Scaffolder

Impact An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. Patches Patched in...

Security Bulletin:Erlang OTP ssh (ssh_sftpd) File Discovery: Sensitive Information Exposure

Summary Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh sshsftpd module allows File Discovery. The SSHFXPREADLINK handler in sshsftpd sends the raw result of file:readlink/2 to the client without calling chrootfilename/2 to strip the backend root prefix...

Security Bulletin:Erlang OTP ssh (ssh_sftpd) File Discovery: Sensitive Information Exposure

Summary Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh sshsftpd module allows File Discovery. The SSHFXPREADLINK handler in sshsftpd sends the raw result of file:readlink/2 to the client without calling chrootfilename/2 to strip the backend root prefix...

GHSA-4XVQ-3M68-H444 Backstage has sensitive information exposure in scaffolder task logs

Impact An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. Patches Patched in...

EUVD-2026-94069

Backstage has sensitive information exposure in scaffolder task logs...

Backstage has sensitive information exposure in scaffolder task logs

Impact An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates. Exploitation requires a denied action whose input contains such a value. Patches Patched in...

EUVD-2026-94451

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker cou...

CVE-2026-20362 Cisco Finesse Server-Side Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct server-side request forgery SSRF attacks through an affected device. This vulnerability is due to improper input validation for specific HTTP requests. An attacker cou...

CVE-2026-106561

Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disclosure in kubernetes resource queries. An authenticated user holding the standard Kubernetes resource read permission could...

CVE-2026-106561 Backstage: Sensitive information disclosure in Kubernetes resource queries

Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disclosure in kubernetes resource queries. An authenticated user holding the standard Kubernetes resource read permission could...

EUVD-2026-94374

Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disclosure in kubernetes resource queries. An authenticated user holding the standard Kubernetes resource read permission could...

CVE-2026-88514

An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information...

GO-2026-6665 Snowflake Go Driver writes sensitive information to logs in github.com/snowflakedb/gosnowflake

Snowflake Go Driver writes sensitive information to logs in github.com/snowflakedb/gosnowflake...

EUVD-2026-94128

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control...

Gitea <1.16.5 - Open Redirect

Gitea before 1.16.5 is susceptible to open redirect via GitHub repository go-gitea/gitea. An attacker can redirect a user to a malicious site and potentially obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-1058 info: name: Gitea 1.16.5 - Open Redire...