SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses
### Summary mcp-searxng version 1.11.0 exposes SearXNG Basic Authentication credentials embedded in the `SEARXNG_URL` e
#cwe-532
共收录 246 条相关情报。
← 返回所有主题GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)
GeoLens 1.2.4 fixes a set of vulnerabilities, the most serious of which allow authenticated or anonymous users to obtain
Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTH...
CVE-2020-37267
Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in serv
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in...
CVE-2019-25766
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain G
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect red...
CVE-2026-75485
A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy o
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed...
CVE-2026-19483
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Stor
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is logged int...
CVE-2026-19483
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Stor
hashi-vault-js: Vault token and secret values exposed in thrown errors
CVE-2026-55102
## Summary Vault token and secret values are exposed in thrown errors when using `hashi-vault-js`. ## Details Every A
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when...
CVE-2026-19502
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, t
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes...
CVE-2026-18097
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were wr...
CVE-2026-19502
MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, t
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a local attacker to obtain sensitive information d...
CVE-2026-18097
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows (includes DB2 Connect Server) could
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submitted through the bulk endpoints (`PATCH /api/v2/variables`...
CVE-2026-68969
Apache Airflow wrote Variable values and Connection `extra` contents to the audit log in cleartext when they were submit
Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()`...
CVE-2026-47234
Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::se
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext...
CVE-2026-18710
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound net
A flaw was found in insights-client. When the application receives a non-200 response, it logs...
CVE-2026-71474
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, whic
A flaw was found in insights-client. The setDefault() function logs the value of every...
CVE-2026-71845
A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes
A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in discon...
CVE-2026-71845
A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. ...
CVE-2026-71474
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, whic
Insertion of sensitive information into log file in the subsystem for the Intel(R) AMT and Intel(R) Standard Manageability may allow an information disclosure. Network adversary...
CVE-2026-20708
Insertion of sensitive information into log file in the subsystem for the Intel(R) AMT and Intel(R) Standard Manageabili