756 matches found
CVE-2026-115358
OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitiv...
CVE-2026-115358
OpenBao versions before 2.6.3 are susceptible to an information disclosure vulnerability. The root cause is the processing of malformed plugin parameters, specifically within TypeKVPair or TypeHeader field values. An attacker can submit these malformed requests to trigger error messages that reco...
EUVD-2026-108283
OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into audit logs by sending malformed plugin parameters. Attackers can submit requests with malformed TypeKVPair or TypeHeader field values, causing error messages containing sensitiv...
CVE-2025-29471
Stored XSS Vulnerability in Nagios Log Server Privilege Escalation to Admin ā¶ļø PoC Demo Date: 2025-04-02 Exploit Author: Seth Kraft Vendor Homepage: https://www.nagios.com/ Vendor Changelog: https://www.nagios.com/changelog/log-server Software Link:...
CVE-2026-111934
Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypa...
CVE-2026-111934 Coder before 2.34.7 IP Spoofing via X-Forwarded-For Header
Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X-Forwarded-For value instead of the client IP appended by a reverse proxy. Attackers can send forged X-Forwarded-For values through appending proxies to bypa...
CVE-2026-111934
Coder versions prior to 2.34.7 are vulnerable to an IP spoofing vulnerability within the ExtractRealIPAddress middleware. The root cause is that the middleware trusts the leftmost, client-supplied X-Forwarded-For value instead of the actual client IP appended by a reverse proxy. This allows attac...
CVE-2026-111644 Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes
Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the getcurrentuser dependency. Attackers can read audit logs with login IPs, server...
CVE-2026-111644
Misaka Danmu Server versions through 2.8.9 are affected by a missing authentication vulnerability (CWE-306) located under the /api/ui routes. The root cause is the lack of the get_current_user dependency on specific endpoints, including audit, diagnostics, data-check, scan-index, and health route...
CVE-2026-111644 Misaka Danmu Server through 2.8.9 Missing Authentication on /api/ui Routes
Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the getcurrentuser dependency. Attackers can read audit logs with login IPs, server...
CVE-2026-18516
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
EUVD-2026-102873
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
CVE-2026-18516
The Audit Logs component of Crafty Controller is vulnerable to an output escaping flaw (CWE-116 ). A remote, unauthenticated attacker can perform stored cross-site scripting (XSS) by leveraging HTTP header injection . No specific remediation or exploit details are provided in the documents.
EUVD-2026-102520
The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...
CVE-2026-18516: Improper Encoding or Escaping of Output
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
CVE-2026-111644: Missing Authentication for Critical Function
Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the getcurrentuser dependency. Attackers can read audit logs with login IPs, server...
PT-2026-115610
Name of the Vulnerable Software and Affected Versions Crafty Controller affected versions not specified Description An output escaping issue in the Audit Logs component allows a remote, unauthenticated attacker to execute stored cross-site scripting XSS through HTTP header injection. Cross-site...
CVE-2026-92228
The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...