CVE Watch9 de nov. de 2026

CVE-2026-118798

Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are

CVSS

—

Sem CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 9 de nov. de 2026 · Última mod.: 9 de nov. de 2026 · CWE-532

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-118467—

—

———Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection.3h CVE-2026-86468—

—

———Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported command shapes leave secrets in cleartext, for example a trailing `--description` on Variable commands, `--conn-extra`, and the inline `--password` of `airflow keycloak-auth-manager` commands. A user who can read audit events but is denied Variable and Connection access can retrieve those values through the event-log API. Users of apache-airflow are recommended to upgrade to 3.4.0 or later. Audit-log entries written before the upgrade keep the cleartext values: purge the affected entries and rotate the secrets they contain. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.2h CVE-2026-812094.9 MÉD

—

——0IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 Standard Edition could allow a remote authenticated attacker to obtain sensitive information due to improper logging of sensitive credentials.20h CVE-2026-127374.4 MÉD

—

——0IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.1_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.1_1 stores potentially sensitive information in log files that could be read by a local privileged user.21h CVE-2026-1235126.1 MÉD

18.6%

——6Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including the token, is written to Vikunja's HTTP access log and any reverse-proxy logs when a user clicks the link. Attackers with read access to those logs can replay an unredeemed password-reset token to take over the account or an account-deletion token to confirm the deletion.2d CVE-2026-1235025.2 MÉD

13.5%

——4Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy access logs can reuse non-expiring, non-password-protected share hashes to obtain a project JWT with read, write or admin permission.1h