kernel: dm log: fix out-of-bounds write due to region_count overflow

A flaw was found in the Linux kernel's device-mapper log dm log component. A local attacker could exploit an integer overflow vulnerability where a 64-bit value is truncated to 32 bits, leading to undersized memory allocations. This allows for out-of-bounds writes to kernel memory during log...

CVE-2026-16608

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's...

CVE-2026-16608 Download Monitor < 5.2.6 - Unauthenticated Download Log Injection

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's...

EUVD-2026-54742

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's...

CVE-2026-16608

The Download Monitor WordPress plugin (before 5.2.6) is affected by an unauthenticated download-logging AJAX action due to missing authorization checks and an exposed nonce. This allows unauthenticated users to inject arbitrary download log entries and inflate site statistics. Root cause: inadequ...

UBUNTU-CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

CVE-2026-54338

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

Security Bulletin: IBM® Db2® federated server could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files. (CVE-2026-18097)

Summary IBM® Db2® could allow a local attacker to obtain sensitive information due to the logging of plain text passwords in trace files. Vulnerability Details CVEID:CVE-2026-18097 DESCRIPTION: DB2 for Linux, UNIX and Windows includes DB2 Connect Server could allow a local attacker to obtain...

SUSE CVE-2026-70368

A stack-based out-of-bounds read vulnerability exists in the "svlog" function of stunnel, when handling oversized log messages via "vsnprintf". A remote attacker with network access to a stunnel service can send protocol inputs that trigger a log message longer than 1024 bytes, leading to an...

CVE-2026-50629

A flaw was found in apache-cxf. The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without proper sanitization. A remote attacker could exploit this by injecting arbitrary content, including fake log entries, into the server's log...

CVE-2026-54201

Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid before...

CVE-2026-54201 TeamDavid: Missing Authorization

Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid before...

CVE-2026-54201

Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid through...

CVE-2026-54201 TeamDavid: Missing Authorization

Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially aiding in further attacks. This issue affects TeamDavid before...

Security Bulletin: due to the use of Apache Log4j, IBM Transformation Extender Advanced is vulnerable to hostname verification bypass and log injection via CRLF sequences

Summary Apache Log4j is used by IBM Transformation Extender Advanced also known as IBM Standards Processing Engine as part of common utility helpers. Apache Log4j has been updated to address CVE-2026-34477 which causes hostname verification bypass and CVE-2026-34478 which causes log injection via...

WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Aydan Arabadzha in WordPress Plugin REST API Log versions = 1.7.1...

PT-2026-69151

Name of the Vulnerable Software and Affected Versions JupyterHub versions prior to 5.5.0 Description Invalid input provided to form-based login authenticators allows an unauthenticated attacker to insert an unbounded, attacker-controlled username into failed-login logs. This can lead to the...

SUSE CVE-2026-64565

In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix heap-buffer-overflow in imspcuprocessdata The imspcuprocessdata processes incoming URB data byte by byte. However, it fails to check if the readpos index exceeds IMSPCUBUFSIZE. If a malicious USB device sends...

CVE-2026-48083

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the /api/log endpoint accepts unauthenticated POST requests, applies no schema validation to the message body, writes attacker-controlled content directly into the...

CVE-2026-48083 OpenReception: Unauthenticated POST /api/log accepts arbitrary content with CRLF injection and no size or rate limits

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the /api/log endpoint accepts unauthenticated POST requests, applies no schema validation to the message body, writes attacker-controlled content directly into the...