32429 matches found
PT-2026-97459
Administrator SQL Injection in Email Log = 2.63 versions...
PT-2026-97529
Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description An unauthenticated remote client can connect to the default-open GET /log WebSocket endpoint. The server parses the first client message as a logger Profile and applies it process-wide using the...
CVE-2026-93421: Improper Output Neutralization for Logs
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...
CVE-2026-93368: Improper Neutralization of Special Elements used in an SQL Command
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' Username Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2026-6327: Improper Output Neutralization for Logs
IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...
CVE-2026-66068: Insertion of Sensitive Information into Log File
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOGDEBUG"shutting down Shovel 'ts', ... Shovel state: tp", Name, State formats the entire state map. The 'uris' field holds plaintext URIs after credentialsobfuscation:decrypt called in...
CVE-2026-94174: Improper Neutralization of Special Elements used in an SQL Command
Administrator SQL Injection in Email Log = 2.63 versions...
CVE-2026-86064: Exposure of Sensitive Information to an Unauthorized Actor
Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in...
CVE-2026-84718: Use of Less Trusted Source
A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...
PT-2026-97546
Name of the Vulnerable Software and Affected Versions Ansible Automation Platform automation-controller affected versions not specified Description In the production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying if it...
PT-2026-97367
Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 3.0.0 Description An unauthorized user can inject data into log messages because the software fails to properly neutralize special elements before writing them to log files. This issue is known as log...
CVE-2026-18161
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header...
CVE-2026-18161 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header...
CVE-2026-18161 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs due to improper validation of a client-supplied HTTP header...
CVE-2026-18161
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to an issue where a remote authenticated attacker can falsify transaction audit logs . The root cause is the improper validation of a client-supplied HTTP header . No specific patch versions or exploit details are provided...
Insertion of Sensitive Information into Log File
Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the handleAgentDeepLink function in NodeAppModel.swift, where the full deep-link URL including any sensitive parameters or tokens...
NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log
NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment cross-project integrity write, bypassing project RBAC and the audit log vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...
Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log
Summary Unleash scopes write permissions per project and per environment: a user with the UPDATEFEATURESTRATEGY permission on project A is supposed to be able to mutate activation strategies only within project A. The endpoint POST...
GHSA-5FFH-6F9Q-5HHR Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log
Summary Unleash scopes write permissions per project and per environment: a user with the UPDATEFEATURESTRATEGY permission on project A is supposed to be able to mutate activation strategies only within project A. The endpoint POST...
