28591 matches found
SUSE CVE-2026-43308
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't BUG on unexpected delayed ref type in runonedelayedref There is no need to BUG, we can just return an error and log an error message...
Insertion of Sensitive Information into Log File
Overview apache-airflow-providers-opensearch is a Provider package apache-airflow-providers-opensearch for Apache Airflow Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the grouplogsbyhost method in ostaskhandler.py. An attacker can expose...
CVE-2026-41018
The Elasticsearch logging provider is vulnerable to credential leakage when configured with a host URL containing embedded credentials (e.g., https://user:[email protected]:9200). The provider writes the full URL, including secrets, into task logs , allowing any user with task-log read ...
CVE-2026-43826
The OpenSearch logging provider in Apache Airflow is vulnerable to credential exposure when the host URL includes embedded credentials (e.g., https://user:[email protected]:9200). The application writes the full URL, including the plaintext credentials , into task logs , allowing any us...
CVE-2026-43826 Apache Airflow Providers OpenSearch: OpenSearch task-log handler leaks credentials embedded in the host URL
The OpenSearch logging provider, when configured with a host URL that embeds credentials for example https://user:[email protected]:9200, wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend...
EUVD-2026-29022
A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function getlogfile of the file /goform/getLogFile of the component httpd. The manipulation of the argument wans.flag leads to os command injection. The attack can be initiated remotely. The exploit...
CVE-2026-8265
A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function getlogfile of the file /goform/getLogFile of the component httpd. The manipulation of the argument wans.flag leads to os command injection. The attack can be initiated remotely. The exploit...
CVE-2026-8265
The CVE-2026-8265 issue affects Tenda AC6 firmware version 15.03.06.23. The vulnerable component is httpd, specifically the function get_log_file in /goform/getLogFile, where manipulating the wans.flag argument leads to an OS command injection. The vulnerability is exploitable remotely and exploi...
CVE-2026-8265
A security vulnerability has been detected in Tenda AC6 15.03.06.23. Affected by this issue is the function getlogfile of the file /goform/getLogFile of the component httpd. The manipulation of the argument wans.flag leads to os command injection. The attack can be initiated remotely. The exploit...
CVE-2026-36906: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in iotgateway v.3.0.1 allows a remote attacker to execute arbitrary code via the Log Record Function...
PT-2026-39902
Name of the Vulnerable Software and Affected Versions Gryph versions prior to 0.7.0 Description Gryph implements logging levels to control content stored in a local sqlite database. The default log level is set to standard, although documentation incorrectly states it is minimal. At both standard...
CVE-2026-36906
Cross Site Scripting vulnerability in iotgateway v.3.0.1 allows a remote attacker to execute arbitrary code via the Log Record Function...
Apache Airflow 日志信息泄露漏洞
Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. This platform features scalability and dynamic monitoring capabilities. The Apache Airflow OpenSearch Provider has a vulnerabilit...
CVE-2026-43826: Insertion of Sensitive Information into Log File
The OpenSearch logging provider, when configured with a host URL that embeds credentials for example https://user:[email protected]:9200, wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend...
CVE-2026-28923: Insertion of Sensitive Information into Log File
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5. A malicious app may be able to break out of its sandbox...
CVE-2026-36906
The IoTGateway software (version 3.0.1 ), a cross-platform industrial IoT gateway used for device connectivity and bidirectional data communication, contains a Cross-Site Scripting (XSS) vulnerability. The root cause is located in the Log Record Function , which fails to properly neutralize input...
Cockpit 操作系统命令注入漏洞
Cockpit is an interactive server management interface developed by Cockpit OpenSource. Cockpit has a vulnerability related to operating system command injection. This vulnerability stems from the lack of cleaning of user-controlled parameters in the system log user interface. This allows remote...
PT-2026-39564
Name of the Vulnerable Software and Affected Versions Tenda AC6 version 15.03.06.23 Description A remote OS command injection exists in the httpd component. The issue occurs within the get log file function of the '/goform/getLogFile' endpoint, where improper manipulation of the wans.flag argumen...
Tenda AC6 命令注入漏洞
Tenda AC6 is a wireless router produced by the Chinese company Tenda. The version 15.03.06.23 of Tenda AC6 has a command injection vulnerability. This vulnerability stems from the function getlogfile in the httpd component’s file/goform, which processes the parameter wan.flag, potentially allowin...