342 matches found
Logging Redactor: PII data in str/repr of non primitive objects was not being redacted
Impact PII data in str/repr of non primitive objects was not being redacted, leading to leakage of PII in logs that should have been redacted for custom str and repr functions Patches The problem has been patched in version 0.0.7. Workarounds None without patching...
GHSA-W7QV-268H-9H3F Logging Redactor: PII data in str/repr of non primitive objects was not being redacted
Impact PII data in str/repr of non primitive objects was not being redacted, leading to leakage of PII in logs that should have been redacted for custom str and repr functions Patches The problem has been patched in version 0.0.7. Workarounds None without patching...
CVE-2026-92121
A flaw was found in Apache WSS4J. This vulnerability allows a remote attacker to bypass security policy enforcement by submitting a specially crafted message using a Security Token Reference STR transformation. Due to an internal state tracking error in the streaming message processor, signature...
CVE-2026-63417
Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object str or repr methods is not redacted when such non-primitive objects are logged, causing...
glibc security update
2.28-251.0.5.48 - Forward port of Oracle patches to 2.28-251.48 Reviewed-by: Kris Van Hees Oracle history: July-28-2026 Cupertino Miranda - 2.28-251.0.5.40 - Fixed orabug 39809344 - Default ldso uses str/mem functions which are not MTE compatible Reviewed-by: Jose E. Marchesi July-23-2026 Cuperti...
PT-2026-136337
Name of the Vulnerable Software and Affected Versions Logging Redactor versions prior to 0.0.7 Description Logging Redactor is a Python library used to redact sensitive data in logs using regex patterns or dictionary keys. The library fails to redact personally identifiable information returned b...
CLEANSTART-2023-LD36694 out-of-bounds read flaw was found in w3m, in the Strnew_size function in Str
Security vulnerability affects the w3m package. An out-of-bounds read flaw was found in w3m, in the Strnewsize function in Str...
CVE-2021-39378
OPENSIS 8.0 SQL INJECTION VULNERABILITY CVE-2021-39378 A SQL Injection vulnerability exists in version 8.0 of openSIS when MySQL MariaDB is being used as the application database. A malicious attacker can issue SQL commands to the MySQL MariaDB database through the vulnerable str= parameter...
OSEC-2026-21 Str partial-match stale capture registers underflow
ANT-2026-KKC4QS4S Str partial-match stale capture registers underflow Str.stringpartialmatch records the beginning and end of a captured group. There was an implicit assumption that beginning end. Str.matchedgroup is safe, it fails with an Invalidargument on groups with beginning end, but...
PT-2026-135865
ANT-2026-KKC4QS4S Str partial-match stale capture registers underflow Str.string partial match records the beginning and end of a captured group. There was an implicit assumption that beginning end. Str.matched group is safe, it fails with an Invalid argument on groups with beginning end, but...
RHLW-2026-422078E03066E6AC Lightwell Security Advisory: wss4j-ws-security-stax 4.0.1.rhlw-00003
Red Hat Lightwell has released org.apache.wss4j:wss4j-ws-security-stax 4.0.1.rhlw-00003 with a backported security fix. CVE-2026-92121: In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The...
PT-2026-120555
e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parse str and concatenated unescaped into a rendered input tag via the form...
PT-2026-117221
A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. This issue affects the function r core cmd str pipe in the library libr/core/rtr http.inc.c of the component HTTP Sandbox Policy Handler. Performing a manipulation results in protection mechanism failure. Remote exploitation of the...
PT-2026-116695
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the ccw device get util str function. This happens when a channel path registry entry associated with a CHPID is removed while the subchannel's PMCW...
PT-2026-128353
In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccw device get util str The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpid to chp can retu...
PT-2026-115418
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-122294
Security vulnerability affects the gst-plugins-good package. The qtdemux tag add str full function in gst/isomp4/qtdemux...
PT-2026-111125
Name of the Vulnerable Software and Affected Versions RAE affected versions not specified Description An issue exists in the Config-Driven Model Instantiation component within the get obj from str function located in the src/utils/model utils.py file. Local manipulation of the Target argument can...
PT-2026-105783
Impact Python's string format functionality allows someone controlling the format string to "read" objects accessible recursively via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy...
CVE-2026-92121
In the WSS4J streaming StAX code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element needs checking, so it stops evaluating SignedParts and...