Weakness (CWE)

CWE-532: Insertion of Sensitive Information into Log File

Base Incomplete

The product writes sensitive information to a log file.

How to prevent it (4 mitigations)

Architecture and Design, Implementation

Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Distribution

Remove debug log files before deploying the application into production.
Operation

Protect log files against unauthorized read/write.
Implementation

Adjust configurations appropriately when software is transitioned from a debug state to production.

Source: MITRE CWE-532

All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

Medium 5.5

CVE-2026-85260 Public exploit

Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payl…

Apache Software Foundation Apache Camel

Oct 19, 2026
High 7.3

CVE-2026-32996 Public exploit

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.

Veeam Backup and Replication

May 28, 2026
High 7.5

CVE-2025-67223 Public exploit

The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs …

Apr 28, 2026
Medium 5.2

CVE-2025-5781 Public exploit

Information Exposure Vulnerability in Hitachi Configuration Manager, Hitachi Ops Center API Configuration Manager

Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager, Hitachi Device Manager allows Session Hijacking.This issue affects Hitachi Ops Center API Configuration Manager: from 10.0.0-00 before 11.0.5-00…

Hitachi Hitachi Device Manager Hitachi Ops Center API Configuration Manager Hitachi Configuration Manager

Feb 25, 2026
High 8.1

CVE-2026-22038 Public exploit

AutoGPT's API Keys and Secrets Logged in Plaintext in Stagehand Integration Blocks

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.46, the AutoGPT platform's Stagehand integration blocks log API keys and authe…

Significant-Gravitas AutoGPT

Feb 4, 2026
Critical 9.8

CVE-2026-22778 Public exploit EPSS 18%

vLLM leaks a heap address when PIL throws an error

vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this l…

vllm-project vLLM vllm PyPI

Feb 2, 2026
Low 3.2

CVE-2026-25211 Public exploit

Llama Stack exposes secret in initialization log

Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.

llamastack Llama Stack llama-stack PyPI

Jan 30, 2026
Critical 9.0

CVE-2025-63729 Public exploit

An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL P…

Nov 25, 2025
Medium 5.5

CVE-2025-43426 Public exploit

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Taho…

Apple macOS iOS and iPadOS macOS iOS

Nov 4, 2025
Critical 9.4

CVE-2024-48852 Public exploit

Information disclosures

Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This issue affects FLXEON through <= 9.3.4.

ABB FLXEON ICS / OT

Jan 29, 2025
High 7.5

CVE-2024-52940 Public exploit

AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address w…

Nov 18, 2024
High 8.2

CVE-2024-9466 Public exploit EPSS 14%

Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential Disclosure

A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials.

Palo Alto Networks Expedition Network devices

Oct 9, 2024
Medium 5.5

CVE-2022-25477 Public exploit

Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer dri…

Jul 2, 2024
High 7.5

CVE-2023-43261 Public exploit EPSS 64%

An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensit…

Oct 4, 2023
Critical 9.9

CVE-2023-40029 Public exploit

Cluster secret might leak in cluster details page in Argo CD

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. p…

argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go

Sep 7, 2023
Critical 9.9

CVE-2021-32724 Public exploit

check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attack

check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling action](https://github.com/marketplace/actions/check-spelling) enabled that triggers on `pull_request_target` (or `schedule`…

check-spelling check-spelling check-spelling/check-spelling GitHub Actions

Sep 9, 2021
Low 2.3

CVE-2020-11932 Public exploit

Subiquity server installer logged LUKS full disk encryption password

It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered.

Canonical subiquity subiquity Ubuntu

May 13, 2020