Apache Sling Engine logs request-derived values without CR/LF neutralization (CVE-2026-103864)
Apache Sling Engine before 3.0.4 does not neutralize CR/LF in logs for request-derived values.
Stories per day · 30 days
2 RSS
Relatedapache1apache-answer1api-keys1broadcom1cisa-kev1credential-leak1cve-2026-649431esxi1oss1sling1vmware1
14 stories, newest first · one card per story
Stories tagged #logging
CISA lists exploited VMware ESX logging flaw CVE-2026-41709
An administrator can omit expected log records; Broadcom rates it CVSS 2.7 and federal remediation is due November 11.
CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication
Apache Answer through 2.0.2 logs full API keys in plaintext; 2.0.3 stops the leak.
Filter, reshape, and redact logs before export with Transformers
Cloudflare Logpush Transformers, now generally available, filter, redact, and reshape logs with SQL before export.
5
CVE-2026-103371: Apache Geode: Management REST API: Insertion of Sensitive Information into Log File
Moderate-severity Apache Geode Management REST API flaw logs sensitive information, with no exploitation reported.
CVE-2026-105241: Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
Apache log4net CVE-2026-105241 lets unencodable Unicode discard an entire SmtpPickupDirAppender email batch.
8 major updates to Cloudflare Observability
Cloudflare combined logs, traces, SQL queries, alerts, and dashboards into one observability platform with new pricing.
10
CVE-2026-78242: Apache APISIX: data-mask may fail to redact request headers in logger output
Apache APISIX 3.17.0 can write unmasked request headers to logs when data-mask fails.
CVE-2026-81862: Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs
Apache Airflow Teradata provider before 3.7.0 embeds cloud storage credentials in SQL and logs (CVE-2026-81862).
GPT4Free Privacy Risks Expose AI Prompts to Third-Party Servers and Hidden Logs
Gen Digital researchers found GPT4Free's hosted chat routes prompts through third-party servers, mislabels models, and logs IPs and conversations for up to 30 days.
CVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log output
Apache Syncope's CVE-2026-87779 exposes AES secret keys in log output when keys use non-standard lengths, rated important.
llm 0.34
Version 0.34 of Simon Willison's llm CLI adds response-duration metrics to log output, plus bug fixes and faster log querying.
CISA's logging guidance works beyond government
CISA released its Logging Reference Architecture in August 2026 to help federal agencies meet OMB M-26-14 logging requirements, usable as a benchmark by critical infrastructure operators.
AWS makes it easier to spot firewall rules that have gone quiet
AWS Network Firewall added rule hit counts for stateful rules, letting teams identify unused rules and validate control effectiveness at no added cost.
1