EUVD-2026-66390

A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances...

CVE-2026-19715

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

EUVD-2026-66876

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-19715

The WP OAuth Server ( Login with WordPress ) WordPress plugin in versions before 6.3.1 is vulnerable to an unauthenticated information disclosure. When debug logging is enabled, the plugin writes to a debug log stored at a fixed and publicly reachable location without restricting access. This all...

CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-81705: Insertion of Sensitive Information into Log File

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied via bundled short-option spellings e.g. -apHunter2 or abbreviated long-option spellings e.g. --passw. The sanitizer only recognized exact option names, --option=value forms, and...

CVE-2026-19715: Exposure of Sensitive Information to an Unauthorized Actor

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-64896: Improper Access Control

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6...

PT-2026-82606

Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9 Description The software fails to redact file passwords in the --debug argv dump when passwords are provided using bundled short-option spellings e.g., -apHunter2 or abbreviated long-option spellings e.g...

PT-2026-82392

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-81715: Insertion of Sensitive Information into Log File

opensslencrypt pip package openssl-encrypt versions = 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitizeargvfordebug fails to sanitize it. As a result the token is printed in cleartext to stderr unde...

PT-2026-82610

Name of the Vulnerable Software and Affected Versions openssl-encrypt versions prior to 1.4.9 Description The sanitize argv for debug function fails to sanitize the keyserver bearer token when passed as a positional argument to the 'keyserver set-token' command. Consequently, when the --debug fla...

PT-2026-82546

Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6...

cakephp/debug_kit: MailPreview contains unsafe reflection

Impact The MailPreview feature of debugkit is vulnerable to arbitrary constructor execution. For an application to be vulnerable the following conditions must be true: 1. debug mode must be enabled. 2. The hostname must match a 'local' domain or be in an allowlist. Patches 5.2.4 and 4.10.3 contai...

CVE-2026-19401

A flaw was found in NSD. A remote attacker can crash an NSD server child by sending a specially crafted message containing a specific number of DNS Cookie options. This continuous crashing can severely hamper or deny DNS service, leading to a denial of service DoS condition. This vulnerability...

CVE-2026-77545

A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances...

CVE-2026-77545

A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances...

CVE-2026-77545

A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug Code vulnerability found in certain devices running UniFi OS to escalate privileges within such UniFi OS devices or instances...

CVE-2026-77545

CVE-2026-77545 is a CRITICAL (CVSS 9.0) vulnerability in certain devices running UniFi OS , rated by Ubiquiti (the CNA). An attacker with network access , low privileges , and user interaction can exploit active debug code left enabled on the device to escalate privileges within the affected UniF...