CVE-2026-0519

LowCVSS 3.4/10Last modified Jun 17, 2026

Description

In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations. Any party with access to those logs could read the token and reuse it to access an integrated system.

Metrics

CVSS 3.1 3.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Jan 17, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-05202.8A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authentic CVE-2026-05216.1A reflected cross-site scripting (XSS) vulnerability in the PDF export functionality of the TYDAC AG MAP+ solution allows unauthenticated at CVE-2026-05228.8A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbit CVE-2026-05287.5Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service through Input Data Mani CVE-2026-05296.5Improper Validation of Array Index (CWE-129) in Packetbeat’s MongoDB protocol parser can allow an attacker to cause Overflow Buffers (CAPEC-CVE-2026-05306.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially CVE-2026-05316.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-130) via a specially CVE-2026-05328.6External Control of File Name or Path (CWE-73) combined with Server-Side Request Forgery (CWE-918) can allow an attacker to cause arbitrary CVE-2026-05338.1A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger CVE-2026-05348.1A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vuln CVE-2026-05358.1A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XS CVE-2026-05367.8A maliciously crafted GIF file, when parsed through Autodesk 3ds Max, can cause a Stack-Based Buffer Overflow vulnerability. A malicious act