PT-2026-89852

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied CryptoWallet values are base64-encoded but not HTML-escaped before storage in wallet log.information. Administrators viewing pending...

PT-2026-90524

A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log-processing component. The only code path in that component using the library issues a request to a single fixed,...

PT-2026-90333

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate dirty page table on log replay Each DIR PAGE ENTRY ends in a page lcns array whose length is the on-disk lcns follow field. check rstbl validates the table bookkeeping but never checks that this array fits in t...

PT-2026-90331

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound page lcns index by the log record The copy lcns loop and the redo shorten loop index page lcns at j + i, where i runs up to the log record's lcns follow. That count is checked only against the record's own length,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107313)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107313 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix tree mod log mishandling of reallocated nodes We have been seeing the following panic...

PT-2026-90447

In the Linux kernel, the following vulnerability has been resolved: cxl/ras: Fix cxl rch get aer info out-of-bounds AER register read cxl rch get aer info copies the RCH Downstream Port AER capability from the RCRB MMIO block using a readl loop bounded by sizeofstruct aer capability regs. This...

PT-2026-89814

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

ImageMagick < 6.9.13-51 / 7.x < 7.1.2-26 Multiple Vulnerabilities

The remote host has a version of ImageMagick installed that is prior to 6.9.13-51, or 7.x prior to 7.1.2-26. It is, therefore, affected by multiple vulnerabilities: - ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation...

org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames

A flaw was found in Apache Log4j Core. This vulnerability allows for log injection through the use of Carriage Return Line Feed CRLF sequences. This occurs because security-related configuration attributes were silently renamed, impacting users who directly configure Rfc5424Layout with stream-bas...

org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output

A flaw was found in Apache Log4j's JsonTemplateLayout. This vulnerability allows a remote attacker to disrupt log processing systems. By sending log events that include specific non-numeric floating-point values, the attacker can cause the JsonTemplateLayout to generate invalid JSON output. This...

GHSA-F52W-8J3H-J724 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

Summary Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form for example GET http:http://internal-vhost/admin HTTP/1.1. Go parses this into URL.Opaque with an empty URL.Path, so Traefik evaluates all routing, path-sanitization, middleware and access-log decisions...

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

Summary Traefik accepts an HTTP/1.x request whose request-target is in rootless / opaque form for example GET http:http://internal-vhost/admin HTTP/1.1. Go parses this into URL.Opaque with an empty URL.Path, so Traefik evaluates all routing, path-sanitization, middleware and access-log decisions...

EUVD-2026-74270

n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check...

NPM: n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

NPM: n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...

n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

Impact A log streaming event destination may reference a generic HTTP credential, and the destination resolved and decrypted whichever credential it named without checking that the caller had access to it. A user holding a custom global role scoped to Log Streaming operations could therefore name...

GHSA-PQ6C-VH67-XPM3 n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check

Impact A log streaming event destination may reference a generic HTTP credential, and the destination resolved and decrypted whichever credential it named without checking that the caller had access to it. A user holding a custom global role scoped to Log Streaming operations could therefore name...

CVE-2026-87993

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

CVE-2026-87993 Consul-template vulnerable to an information disclosure issue in error handling

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

Insertion of Sensitive Information into Log File

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File incomplete sanitization of TLS private keys in log output. An attacker can obtain sensitive cryptographic material by accessing logs where the private ke...

org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output

A flaw was found in Apache Log4j's JsonTemplateLayout. This vulnerability allows a remote attacker to disrupt log processing systems. By sending log events that include specific non-numeric floating-point values, the attacker can cause the JsonTemplateLayout to generate invalid JSON output. This...