27907 matches found
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration
A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...
go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission
A flaw was found in the OpenTelemetry-Go BatchingProcessor component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper...
go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission
A flaw was found in the OpenTelemetry-Go BatchingProcessor component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper...
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration
A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...
Sentinel-GPT
Sentinel-GPT: Agentic AI for Threat Hunting 🛡️ An automated cybersecurity pipeline that transforms raw Azure logs into actionable intelligence using LLM-based reasoning. 📖 Overview Sentinel-GPT is an AI Agent specialised for threat hunting in cybersecurity. It is integrated with Azure Log Analytic...
EUVD-2026-57010
Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 /env, /loggers bypass API basic-auth...
CVE-2026-90412
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmetexecutegetlogpagermi leaves 'status' holding NVMESCSUCCESS set by the successful nvmetreqfindns call when the kzalloc for the log buffer fails. It then jumps to...
CVE-2026-90412 nvmet: fix return status of RMI log page on allocation failure
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmetexecutegetlogpagermi leaves 'status' holding NVMESCSUCCESS set by the successful nvmetreqfindns call when the kzalloc for the log buffer fails. It then jumps to...
EUVD-2026-82073
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix return status of RMI log page on allocation failure nvmetexecutegetlogpagermi leaves 'status' holding NVMESCSUCCESS set by the successful nvmetreqfindns call when the kzalloc for the log buffer fails. It then jumps to...
CVE-2026-90412
CVE-2026-90412 affects the Linux kernel nvmet (NVM Express target) subsystem. The function nvmet_execute_get_log_page_rmi() fails to update the status variable when kzalloc() for the log buffer fails, leaving it at NVME_SC_SUCCESS from an earlier nvmet_req_find_ns() call. As a result, the NVMe ho...
CVE-2026-86522
Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...
CVE-2026-92918
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access...
nginx-rift-detector
NGINX Rift Detector for CVE-2026-42945 Read-only Bash checker for owned NGINX servers. It helps an operator answer two questions after the CVE-2026-42945 disclosure: Is this server still running an exposed NGINX build or risky rewrite configuration? Do local logs show crash, long-URI, or encoding...
CVE-2026-81632 Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access logs, proxy logs or browser history to recover a single-use sign-in token and authenticate as its owner. After a successful password sign-in,...
EUVD-2026-81482
Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...
CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication
Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...
CVE-2026-86522
AshAuthentication (team-alembic, Elixir/Phoenix) contains a log injection flaw in AshAuthentication.Strategy.Password.RequestPasswordReset.run/3. The identity argument—supplied directly from the password-reset request—is interpolated into Logger.warning/1 heredocs without escaping, truncating, or...
CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication
Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...
CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication
Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...
EEF-CVE-2026-86522 Log injection via an unescaped password reset identity in AshAuthentication
Summary Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters...