CVE-2026-92918 admin3 through 3.0.0 Session Token Disclosure via Audit Log

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access...

EUVD-2026-81573

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access...

EUVD-2026-81424

In Eclipse Ankaios versions 0.6.0 to before 1.0.4, LogRule::matches in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of evaluating later entries, which can cause deny LogRule entries to be skipped and allow unauthorized access to another...

CVE-2026-92611

In Eclipse Ankaios versions 0.6.0 to before 1.0.4, LogRule::matches in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of evaluating later entries, which can cause deny LogRule entries to be skipped and allow unauthorized access to another...

CVE-2026-92611

In Eclipse Ankaios versions 0.6.0 to before 1.0.4, LogRule::matches in the agent control-interface authorizer stops at the first wildcard pattern in a single rule instead of evaluating later entries, which can cause deny LogRule entries to be skipped and allow unauthorized access to another...

CVE-2026-85130

The WPLP Cookie Consent WordPress plugin (versions before 4.4.4 ) contains an unauthenticated stored XSS vulnerability. The root cause is a failure to escape values submitted through a public endpoint before they are output in a JavaScript context on an administrative screen. This allows unauthen...

CLEANSTART-2026-FS45115 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Multiple security vulnerabilities affect the atlantis package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...

CVE-2026-86522: Improper Output Neutralization for Logs

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...

PT-2026-94300

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.2.0 through 4.14.9 ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description An unauthenticated attacker can forge application log entries by submitting a password reset identity containing newlines o...

CVE-2026-54237: Improper Control of Generation of Code

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...

PT-2026-94249

Name of the Vulnerable Software and Affected Versions admin3 version 3.0.0 Description User session tokens are persisted in the audit log event body during the publishing of UserLoggedIn domain events. An attacker with log:view permission can access these tokens by reading the JSON response from...

Linux Distros Unpatched Vulnerability : CVE-2026-84501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauthensemble, ... request...

CVE-2026-92918: Insertion of Sensitive Information into Log File

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access...

PT-2026-94295

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.12.0 through 4.14.x ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.1 Description AshAuthentication allows the disclosure of user password digests to readers of the audit store. The audit log add-on builds...

PT-2026-95089

Name of the Vulnerable Software and Affected Versions Wavelog versions 1.8 through 2.4.1 Description Wavelog exposes the endpoints '/install/ajax.php' and '/install/includes/interface assets/triggers.php' after installation without requiring an installation lock or permission check. Unsanitized...

PT-2026-94760

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvmet execute get log page rmi function where the status variable retains a success value NVME SC SUCCESS even when kzalloc fails to allocate the log buffer. This...

Linux Distros Unpatched Vulnerability : CVE-2026-84439

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending ...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the newGRPCDialOptions not applying the loaded TLS configuration from environment variables when creating gRPC transport credentials. An attacker can intercept or spoof the collector connection usi...

CVE-2026-92809

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs...

CVE-2026-81871

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...