CWE-532 · Information Disclosure
Sensitive Data in Logs
1,221CVEs
2exploited
8with a public check
3likely (EPSS 10%+)
SortMost likely exploited
1,221 CVEs with CWE-532 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-21492In CISA KEVExploitedKernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.Samsung Mobile · Samsung Mobile Devices · CVSS 4.4 · 2023-05-04 | 4.4 | 2.6% | 2023-05-04 |
| CVE-2025-24984In CISA KEVExploitedWindows NTFS Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1507 · CVSS 4.6 · 2025-03-11 | 4.6 | 2.0% | 2025-03-11 |
| CVE-2023-43261CheckMilesight Routers - Information DisclosureMilesight · Ur5x Firmware · CVSS 7.5 · 2023-10-04 | 7.5 | 64% | 2023-10-04 |
| CVE-2020-35234CheckSMTP WP Plugin Directory ListingWp-Ecommerce · Easy Wp Smtp · 2020-12-14 | – | 60% | 2020-12-14 |
| CVE-2024-20440CheckCisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext CredentialsCisco · Cisco Smart License Utility · CVSS 7.5 · 2024-09-04 | 7.5 | 52% | 2024-09-04 |
| CVE-2026-22778CheckvLLM 0.8.3 - 0.14.0 - Information Disclosurevllm-project · vllm · CVSS 9.8 · 2026-02-02 | 9.8 | 18% | 2026-02-02 |
| CVE-2018-8719CheckWordPress WP Security Audit Log 3.1.1 - Information DisclosureWpsecurityauditlog · Wp Security Audit Log · 2018-04-04 | – | 16% | 2018-04-04 |
| CVE-2025-9985CheckFeatured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log Filemarceljm · Featured Image from URL (FIFU) · CVSS 5.3 · 2025-09-26 | 5.3 | 13% | 2025-09-26 |
| CVE-2025-14437CheckWordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log Filewpmudev · Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals |… · CVSS 7.5 · 2025-12-18 | 7.5 | 1.8% | 2025-12-18 |
| CVE-2026-54236CheckvLLM <= 0.23.0 - Anthropic Router Heap Address Information Leakvllm-project · vllm · CVSS 5.3 · 2026-06-22 | 5.3 | 0.9% | 2026-06-22 |
| CVE-2018-11716An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critic…Zohocorp · Manageengine Desktop Central · 2018-07-16 | – | 14% | 2018-07-16 |
| CVE-2024-9466Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential DisclosurePalo Alto Networks · Expedition · CVSS 8.2 · 2024-10-09 | 8.2 | 14% | 2024-10-09 |
| CVE-2018-12604GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log.Njtech · Greencms · 2018-06-20 | – | 13% | 2018-06-20 |
| CVE-2018-11717An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain (depending on the modules c…Zohocorp · Manageengine Desktop Central · 2018-07-16 | – | 8.6% | 2018-07-16 |
| CVE-2019-0741An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information Disclosure Vulnerability'.Microsoft · Java SDK for Azure IoT · 2019-03-06 | – | 7.4% | 2019-03-06 |
| CVE-2020-1928An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal v…Apache Software Foundation · Apache NiFi · 2020-01-28 | – | 4.0% | 2020-01-28 |
| CVE-2019-13509In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug lo…Docker · Docker · 2019-07-18 | – | 3.7% | 2019-07-18 |
| CVE-2012-0814The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticat…Openbsd · Openssh · CVSS 6.5 · 2012-01-27 | 6.5 | 3.6% | 2012-01-27 |
| CVE-2001-1556The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTT…Apache · Http Server · 2005-07-14 | – | 3.6% | 2005-07-14 |
| CVE-2020-9486In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition c…Apache · Apache NiFi · 2020-10-01 | – | 3.6% | 2020-10-01 |
| CVE-2017-7550A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to ex…Red Hat, Inc. · ansible · 2017-11-21 | – | 3.5% | 2017-11-21 |
| CVE-2019-11336Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as an access point) by using the Photo Sharing Plus applicati…Sony · Photo Sharing Plus · 2019-05-14 | – | 3.2% | 2019-05-14 |
| CVE-2020-1942In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join…Apache · Apache NiFi · 2020-02-11 | – | 3.1% | 2020-02-11 |
| CVE-2013-1771The web server Monkeyd produces a world-readable log (/var/log/monkeyd/master.log) on gentoo.monkey · monkey · 2019-11-07 | – | 3.0% | 2019-11-07 |
| CVE-2018-10855Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a ta…Redhat · ansible · CVSS 5.9 · 2018-07-02 | 5.9 | 3.0% | 2018-07-02 |
| CVE-2019-3888A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs…Red Hat · undertow · CVSS 5.3 · 2019-06-12 | 5.3 | 3.0% | 2019-06-12 |
| CVE-2018-0504Information disclosure in Special:Redirect/logidmediawiki · mediawiki · 2018-10-04 | – | 2.9% | 2018-10-04 |
| CVE-2018-7204inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. If a user edits the…Giribaz · File Manager · 2018-03-07 | – | 2.8% | 2018-03-07 |
| CVE-2020-11968In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occ…Evenroute · Iqrouter Firmware · 2020-04-21 | – | 2.7% | 2020-04-21 |
| CVE-2021-34797Apache Geode project log file redaction of sensitive information vulnerabilityApache Software Foundation · Apache Geode · 2022-01-04 | – | 2.6% | 2022-01-04 |
| CVE-2016-6799Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i(), Log.w(), and Log.e(…Apache Software Foundation · Apache Cordova Android · 2017-05-09 | – | 2.6% | 2017-05-09 |
| CVE-2024-48852Information disclosuresABB · FLXEON · CVSS 9.4 · 2025-01-29 | 9.4 | 2.4% | 2025-01-29 |
| CVE-2017-15572In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password d…Redmine · Redmine · 2017-10-18 | – | 2.4% | 2017-10-18 |
| CVE-2022-26907Azure SDK for .NET Information Disclosure VulnerabilityMicrosoft · Azure SDK for .Net · CVSS 5.3 · 2022-04-15 | 5.3 | 2.4% | 2022-04-15 |
| CVE-2018-1000060Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redact_sensitive() that c…Sensu · Sensu Core · 2018-02-09 | – | 2.4% | 2018-02-09 |
| CVE-2021-32724check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attackcheck-spelling · check-spelling · CVSS 9.9 · 2021-09-09 | 9.9 | 2.3% | 2021-09-09 |
| CVE-2018-10889A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted w…Moodle · moodle · CVSS 4.3 · 2018-07-10 | 4.3 | 2.3% | 2018-07-10 |
| CVE-2017-7214An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appeari…Openstack · Nova · 2017-03-21 | – | 2.3% | 2017-03-21 |
| CVE-2019-4008API Connect V2018.1 through 2018.4.1.1 is impacted by access token leak. Authorization tokens in some URLs can result in the tokens being written to log files. IBM X-Force ID: 155…IBM · API Connect · CVSS 9 · 2019-02-07 | 9.0 | 2.3% | 2019-02-07 |
| CVE-2015-8977MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving err…Mybb · Merge System · 2017-01-31 | – | 2.2% | 2017-01-31 |
| CVE-2013-4733The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 allows remote attackers to obtain sensit…Digital Alert Systems · Dasdec Eas · CVSS 7.5 · 2013-06-29 | 7.5 | 2.2% | 2013-06-29 |
| CVE-2016-0879Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain…Moxa · Edr-G903 Firmware · 2016-05-31 | – | 2.2% | 2016-05-31 |
| CVE-2018-19865A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3.Qt · Qt · 2018-12-05 | – | 2.2% | 2018-12-05 |
| CVE-2018-16049An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Disclosure in Sidekiq Log…Gitlab · Gitlab · 2018-10-03 | – | 2.1% | 2018-10-03 |
| CVE-2012-1156Moodle before 2.2.2 has users' private files included in course backupsMoodle · Moodle · 2019-11-14 | – | 2.1% | 2019-11-14 |
| CVE-2018-19513In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The log file could contain sensit…Ens · Webgalamb · 2019-03-17 | – | 2.1% | 2019-03-17 |
| CVE-2016-8346An issue was discovered in Moxa EDR-810 Industrial Secure Router. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access conf…Moxa · Moxa EDR-810 Industrial Secure Router · 2017-02-13 | – | 2.1% | 2017-02-13 |
| CVE-2023-22649Rancher 'Audit Log' leaks sensitive informationSUSE · rancher · CVSS 8.4 · 2024-10-16 | 8.4 | 2.0% | 2024-10-16 |
| CVE-2019-9929Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions.Northern · Cfengine · 2019-06-06 | – | 2.0% | 2019-06-06 |
| CVE-2018-17447An Information Exposure Through Log Files issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.Citrix · Netscaler Sd-Wan · 2018-10-23 | – | 1.9% | 2018-10-23 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.