PT-2026-94249

Name of the Vulnerable Software and Affected Versions admin3 version 3.0.0 Description User session tokens are persisted in the audit log event body during the publishing of UserLoggedIn domain events. An attacker with log:view permission can access these tokens by reading the JSON response from...

CVE-2026-92918: Insertion of Sensitive Information into Log File

admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access...

PT-2026-94295

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.12.0 through 4.14.x ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.1 Description AshAuthentication allows the disclosure of user password digests to readers of the audit store. The audit log add-on builds...

PT-2026-94296

Name of the Vulnerable Software and Affected Versions ash authentication versions 4.12.0 through 4.14.x ash authentication versions 5.0.0-rc.0 through 5.0.0-rc.13 Description AshAuthentication contains an issue where readers of the audit store can recover client IP addresses that the audit log...

CVE-2026-92809

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs...

CVE-2026-92809 PrestaShop psgdpr through 1.4.3 GDPR Log Forgery

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs...

EUVD-2026-81067

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs...

CVE-2026-92809

CVE-2026-92809 affects the PrestaShop psgdpr module (versions through 1.4.3 ). The vulnerability is an IDOR (Insecure Direct Object Reference) in GDPR consent logging: the module fails to validate that submitted consent log entries belong to the authenticated customer. An authenticated attacker c...

CVE-2026-92809 PrestaShop psgdpr through 1.4.3 GDPR Log Forgery

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs...

OPENSUSE-SU-2026:21870-1 Security update for openai-codex

This update for openai-codex fixes the following issues: Changes in openai-codex: Update to version 0.154.0: Experimental worktree support for isolated checkouts of new or forked sessions, with browse and resume Answer questions inline while Codex keeps working, keeping the main draft Vim R repla...

Important: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.2.13

Logging for Red Hat OpenShift - 6.2.13 Red Hat OpenShift Logging 6.2.13 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs...

CVE-2026-92460

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...

EUVD-2026-80665

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...

CVE-2026-92460

CVE-2026-92460 affects yshop-crm through 2.1.3 , a CRM application. The vulnerability is a missing authorization check on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide operation log without proper permission checks. Ex...

CVE-2026-92460 yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...

CVE-2026-92460 yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing

yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to access the installation-wide audit trail. Attackers can query the operation log to retrieve operator names, display nicknames, client IP...

YellowKey-BitLocker-CVE-2026-45585

YellowKey BitLocker YellowKey BitLocker Recovery Tool respalda las claves de recuperación de BitLocker y audita CVE-2026-45585 en Windows 10/11. Las búsquedas de bitlocker yellowkey , yellowkey bitlocker , yellowkey github y yellowkey vulnerability aterrizan aquí. CLI + GUI portátil para volúmene...

CVE-2026-84439

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

UBUNTU-CVE-2026-84439

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

Improper Output Neutralization for Logs

Overview org.apache.zookeeper:zookeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs in the audit logging...