Skip to content
CVE Tracker

CWE-532: Sensitive information in a log file

1,326 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

All 1,326 in the listAtom feed of new CVEsWhat CWE-532 is, at MITRE (opens in a new tab)
Published CVEs
1,326
Last 12 months
323
Critical
57
Known exploited
2

Critical 57High 297Medium 809Low 163Not scored 0

CVEs per yearBy the year they were published

  1. 201866
  2. 201919
  3. 20191
  4. 20192
  5. 2022102
  6. 2024128
  7. 2025175
  8. 2026271
  9. 2026179
  10. 2026149
  11. 202686
  12. 2026105

Known exploitedNewest addition to KEV first

  • CVE-2025-24984

    Windows NTFS Information Disclosure Vulnerability

    Microsoft · Windows 10 Version 1507

    ExploitedMedium4.6
  • CVE-2023-21492

    Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.

    Samsung Mobile · Samsung Mobile Devices

    ExploitedMedium4.4

Newest CVEs

  • CVE-2026-120673

    Rust Driver 3.9.1 exports CSFLE plaintext in `db.query.text` before encrypting the command

    MongoDB · Rust Driver

    Medium6.8
  • CVE-2026-63417

    Logging Redactor: PII data in str/repr of non primitive objects was not being redacted

    armurox · loggingredactor

    High8.2
  • CVE-2026-121023

    LDAP Bind Password Exposure in AxxonNet ARP Agent Logs

    AxxonSoft · AxxonNet ARP Agent

    Medium6.8
  • CVE-2026-18800

    Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data

    WSO2 · WSO2 API Manager

    Medium4.4
  • CVE-2026-20592

    In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to local information disclosure if a malicious…

    MediaTek, Inc. · MediaTek chipset

    Medium4.1
  • CVE-2026-62347

    Element Call exposes shared passwords in logs

    element-hq · element-call

    Medium5.9
  • CVE-2026-119117

    Insertion of sensitive information into a log file and process argument list in the Amazon Kinesis Producer Library for Java

    AWS · amazon-kinesis-producer

    High8.2
  • CVE-2026-119290

    Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run

    zuke-build · zuke

    High7.5
  • CVE-2026-59388

    Cloud Controller exposes secrets in audit log

    Cloud Foundry Foundation · CAPI (Cloud Foundry Controller)

    Medium6.5
  • CVE-2026-90861

    Password Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server

    Progress Software · WS_FTP Server

    Medium6.6

Vendors it comes up for most

  1. IBM84
  2. Dell57
  3. Apple44
  4. Apache Software Foundation36
  5. Red Hat34
  6. Elastic28
  7. Microsoft27
  8. Samsung Mobile26
  9. Brocade20
  10. Cisco20