CVE-2026-103371

HighCVSS 7.5/10Last modified Oct 8, 2026

Description

Insertion of Sensitive Information into Log File in Apache Geode Web Management.

This issue affects Apache Geode: from 2.0.0 before 2.0.3.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 7, 2026
Last modified
Oct 8, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1033765.3The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.1CVE-2026-1033786.5The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its CVE-2026-1033804.3The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive InformationCVE-2026-1033874.3A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of theCVE-2026-1033886.2MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validaCVE-2026-1033896.2MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persCVE-2026-1033959.8LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-sCVE-2026-1033964.3bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.useCVE-2026-1033975.6OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired dCVE-2026-1033988.1OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specifyCVE-2026-1033995.3A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServCVE-2026-1034128.8Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file name
CVE-2026-103371: High severity, CVSS 7.5 | Vulnix