CVE-2026-67339 guzzlehttp/guzzle before 7.14.2 Proxy-Authorization Header Disclosure

guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle...

PT-2026-67086

The Icegram Mailer plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in versions up to, and including, 1.0.12. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the Icegram Mailer Logs...

WordPress Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs plugin <= 1.0.12 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Icegram Mailer – Reliable Email Deliverability, No-code SMTP Replacement & Email logs versions = 1.0.12...

CVE-2026-54715

A flaw was found in GoAccess, a real-time web log analyzer. A remote attacker could exploit this vulnerability by providing a specially crafted User-Agent string in an access log. This improper handling by the parsebrowser function leads to a heap out-of-bounds write, a type of memory corruption...

Security Bulletin: IBM WebSphere Automation is vulnerable to multiple CVEs affecting multiple mongo packages within MongoDB

Summary IBM WebSphere Automation is vulnerable to multiple CVEs affecting the mongod, mongodb & mongos packages within MongoDB. Vulnerability Details CVEID:CVE-2026-8053 DESCRIPTION: An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database writ...

PT-2026-66733

The HTTP server component of ANDRITZ HIPASE-250 formerly 250 SCALA in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network access to the service may suppress audit...

How to Prevent Veeam Reverse Proxy Service From Locking Port 80

Purpose The Veeam Reverse Proxy Service, a component of Veeam Backup & Replication, binds to port 80 by default in order to redirect HTTP requests to HTTPS on port 443. This article explains how to disable HTTPS redirection so that the service listens only on port 443, allowing port 80 to be clos...

The vulnerability of the NetworkClient component of the Apache Kafka messaging broker allows a attacker to gain unauthorized access to confidential information.

The vulnerability of the NetworkClient component in the Apache Kafka messaging broker is related to the disclosure of information through Server Logs. Exploiting this vulnerability could allow an attacker to gain unauthorized access to confidential information...

CVE-2026-10569

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an...

EUVD-2026-51275

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an...

CVE-2026-10569 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Exposure of Sensitive Information Vulnerability

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an...

CVE-2026-10569 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Exposure of Sensitive Information Vulnerability

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an...

CVE-2026-10569

IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy are affected by CVE-2026-10569 due to exposure of sensitive information in plugin output logs. Affected products/versions: UCD 7.2–7.2.3.23; 7.3–7.3.2.18; DevOps Deploy 8.0–8.0.1.13; 8.1–8.1.2.6; 8.2–8.2.1.0. Root cause: plugin output logs may reve...

CVE-2026-10569

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an...

SUSE CVE-2026-34969

Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into the redirect URL as a query parameter. Refresh tokens in URLs are logged in browser history, server access logs, HTTP Referer headers,...

SUSE CVE-2026-40091

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level info, the startup "configuration" log will include the full datastore DSN, including the plaintext password, inside...

SUSE CVE-2026-41185

When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegating to the IPAM plugin. After mutating, the Azure IPAM helper logs the entire unmarshaled configuration map stdinData at INFO level to...

SUSE CVE-2026-42295

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Gi...

SUSE CVE-2026-44514

Kubetail is a real-time logging dashboard for Kubernetes. Prior to 0.14.0, Kubetail's dashboard exposes WebSocket endpoints that did not adequately validate the Origin header on connection upgrade. A malicious web page visited by a user with an active Kubetail session could open a WebSocket to th...

SUSE CVE-2026-44883

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer's authentication middleware accepts JWT bearer tokens passed...