https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T14:52:53.214584+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-242477 EUVD-2026-242477 2026-10-08T14:52:53.264928+00:00 EUVD-2026-242477 https://cve.radiocsirt.org/vuln/fkie_cve-2025-48955 fkie_cve-2025-48955 2026-10-08T14:52:53.264973+00:00

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes. Version 1.50.8 fixes the issue.

 https://cve.radiocsirt.org/vuln/ghsa-v75g-77vf-6jjq GHSA-v75g-77vf-6jjq — Para Server Logs Sensitive Information 2026-10-08T14:52:53.265021+00:00

Affected: Maven: com.erudika:para-server

CWE ID: CWE-532 (Insertion of Sensitive Information into Log File) CVSS: 7.5 (High) Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

**Affected Component:** Para Server Initialization Logging **Version:** Para v1.50.6 **File Path:** `para-1.50.6/para-server/src/main/java/com/erudika/para/server/utils/HealthUtils.java` **Vulnerable Line(s):** Line 132 (via `logger.info(...)` with root credentials)

Technical Details:

The vulnerability is located in the HealthUtils.java file, where a failed configuration file write triggers the following logging statement: ```java logger.info("Initialized root app with access key '{}' and secret '{}', but could not write these to {}.", rootAppCredentials.get("accessKey"), rootAppCredentials.get("secretKey"), confFile); ``` This exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require logging for debugging or system health purposes.