CVE-2025-29471

Stored XSS Vulnerability in Nagios Log Server Privilege Escalation to Admin ▶️ PoC Demo Date: 2025-04-02 Exploit Author: Seth Kraft Vendor Homepage: https://www.nagios.com/ Vendor Changelog: https://www.nagios.com/changelog/log-server Software Link:...

CVE-2026-59388

Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...

CVE-2026-59388 Cloud Controller exposes secrets in audit log

Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...

EUVD-2026-113754

Cloud Controller CAPI leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service...

CVE-2026-59388

The Cloud Controller (CAPI) for Cloud Foundry suffers from a vulnerability where sensitive secrets are leaked into audit logs. Specifically, custom buildpack credentials are exposed during application manifest application, creation, and updates. Additionally, syslog drain URL credentials are leak...

BIT-OPENBAO-2026-115358 OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitiv...

CVE-2026-115358

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitiv...

CVE-2026-115358 OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitiv...

EUVD-2026-108283

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitiv...

CVE-2026-115358 OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitiv...

CVE-2026-115358

OpenBao versions before 2.6.3 are susceptible to an information disclosure vulnerability. The root cause is the processing of malformed plugin parameters, specifically within TypeKVPair or TypeHeader field values. An attacker can submit these malformed requests to trigger error messages that reco...

CVE-2026-115358

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitiv...

CVE-2026-115358 OpenBao before 2.6.3 Sensitive Data Leak in Audit Log via Malformed Parameters

OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitiv...

OpenBao log information leakage vulnerability

Versions prior to OpenBao 2.6.3 and versions 2.7.0 through 2.7.1 contain a log information leakage vulnerability. This vulnerability arises when plugin parameters such as malformed TypeKVPair or TypeHeader field values are sent, resulting in error messages containing sensitive inputs being logged...

PT-2026-121538

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.3 Description An information disclosure issue exists where attackers can leak sensitive data into audit logs by sending malformed plugin parameters. By submitting requests with malformed TypeKVPair or TypeHeader...

CVE-2026-111934

Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypa...

CVE-2026-111934

Coder versions prior to 2.34.7 are vulnerable to an IP spoofing vulnerability within the ExtractRealIPAddress middleware. The root cause is that the middleware trusts the leftmost, client-supplied X-Forwarded-For value instead of the actual client IP appended by a reverse proxy. This allows attac...

CVE-2026-111934 Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header

Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypa...

CVE-2026-111934

Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypa...

CVE-2026-111934 Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header

Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypa...