CVE-2026-47832
The vulnerability lies in the way application credentials are handled within the BOSH deployment. bosh-openstack-cpi-release: all versions f
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 12, 2026 · Last modified: Nov 12, 2026 · CWE-532
Not enough EPSS history yet.
The vulnerability lies in the way application credentials are handled within the BOSH deployment. bosh-openstack-cpi-release: all versions from v55 to v55.0.4 (inclusive)
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-918917.5 HIG—
——0Dell Terraform Provider for PowerStore, versions prior to 1.3.1 , contains a vulnerability that may cause sensitive authentication data to be insufficiently redacted in diagnostic logs. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.18hCVE-2026-918798.8 HIG—
——0Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains an insertion of sensitive information into Log File vulnerability in the client initialization component. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access.19hCVE-2026-918725.5 MED—
——0Dell Ansible Storage for PowerStore, versions prior to 3.9.0,contains an Insertion of Sensitive Information into Log File vulnerability in the configuration module. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.19hCVE-2026-1209766.0 MED3.1%
——1On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade (SSU).
An attacker with administrative access on the device who obtains the affected diagnostic data could recover sensitive authentication information. This could potentially compromise the confidentiality and integrity of traffic protected by MACsec on the affected link.
The vulnerability is only exposed during and after an SSU reload where an active 802.1X session used for MACsec is present.2dCVE-2026-1207927.3 HIG36.7%
——11Insertion of sensitive information into log file in Aspire allows an authorized attacker to disclose information locally.1dCVE-2026-123082—1.4%
——0Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token (a JWT) in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when it requested it from the backend. An attacker with read access to these files could obtain the token and use it to read and modify the user's Docker Hub data as that user while the token remains valid. Docker Desktop 4.94.0 redacts these payloads. The fix does not rewrite logs written by earlier versions, which can still contain tokens after upgrading.2d