30648 matches found
PT-2026-52837
Mattermost Plugins versions =11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with access to server logs or support packets to obtain a valid or partially reconstructable OpenAI API key via inspection of mattermost.log entries...
PT-2026-52894
Name of the Vulnerable Software and Affected Versions Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2 Description Envoy can crash when the %REQUESTED SERVER NAMEX:Y% variable is used in the log format and host-related options such as HOST FIRST or SNI FIRST are specified...
Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : cpp-httplib vulnerability (USN-8470-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8470-1 advisory. It was discovered that cpp-httplib incorrectly percent-decoded HTTP request header values. A remote attacker could use this to...
GO-2026-5770 Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber in github.com/ellanetworks/core
Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber in github.com/ellanetworks/core...
GO-2026-5677 OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers in go.opentelemetry.io/obi
OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers in go.opentelemetry.io/obi...
GO-2026-5586 nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator in github.com/juev/nebula-mesh
nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator in github.com/juev/nebula-mesh...
GO-2026-5622 Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd
Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd...
GO-2026-5451 Juju: Read All Controller Logs From Compromised Workload in github.com/juju/juju
Juju: Read All Controller Logs From Compromised Workload in github.com/juju/juju...
Malicious code in log-update-ts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dbad34a92b1a5080681d7966e3c807324847605ee60f874076b85e336860def Package masquerades as Sindre Sorhus's popular 'log-update' library matching name and description claiming 'Log by overwriting the previous output in...
MAL-2026-6483 Malicious code in log-update-ts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dbad34a92b1a5080681d7966e3c807324847605ee60f874076b85e336860def Package masquerades as Sindre Sorhus's popular 'log-update' library matching name and description claiming 'Log by overwriting the previous output in...
Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
Description The Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing maxapkmetadatasize check default 1MB is only applied to individual tar entry...
GHSA-47Q9-M4WW-924M Rekor has an OOM Condition due to Unbounded gzip Decompression in Alpine APK Parsing Logic
Description The Package.Unmarshal function in pkg/types/alpine/apk.go decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing maxapkmetadatasize check default 1MB is only applied to individual tar entry...
CVE-2026-53048
A flaw was found in the Linux kernel's gfs2 filesystem. During the unmount process, a NULL pointer dereference can occur when flushing outstanding glock work. This happens because gfs2logflush is called when a critical data structure sdp-sdjdesc has already been deallocated, and a subsequent...
CVE-2026-53049
A flaw was found in the Linux kernel's Global File System 2 GFS2 component. The gfs2logd function, responsible for log flushing, calls several log flushing functions without holding the required lock. This omission allows concurrent transactions to access shared resources without proper exclusion...
CVE-2026-53059
A flaw was found in the Linux kernel's device-mapper log dm log component. A local attacker could exploit an integer overflow vulnerability where a 64-bit value is truncated to 32 bits, leading to undersized memory allocations. This allows for out-of-bounds writes to kernel memory during log...
OPENSUSE-RU-2026:21160-1 Recommended update for dnscrypt-proxy
This update for dnscrypt-proxy fixes the following issues: Changes in dnscrypt-proxy: - Update to version 2.1.16 The "tlsciphersuite" option is now a no-op. Modern TLS stacks no longer expose cipher suite selection in a meaningful way, and the option had become misleading A log size of 0 no longe...
CVE-2026-56005
Subscriber Cross Site Scripting XSS in WP Activity Log = 5.6.3.1 versions...
CVE-2026-56005
Subscriber Cross Site Scripting XSS in WP Activity Log = 5.6.3.1 versions...
