CVE-2026-100514

Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...

CVE-2026-100514

The WordPress REST API Log plugin affects versions

EUVD-2026-90842

Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...

CVE-2026-100514 WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...

CVE-2026-100514 WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in REST API Log = 1.7.2 versions...

WordPress REST API Log plugin < 1.7.1 - Unauthenticated Sensitive Log Data Disclosure via Download Endpoint vulnerability

Unauthenticated Sensitive Log Data Disclosure via Download Endpoint vulnerability discovered by Shikhali Jamalzade in WordPress Plugin REST API Log versions 1.7.1...

CVE-2026-66443

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

CVE-2026-66443 WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

CVE-2026-66443

CVE-2026-66443 affects the WordPress REST API Log plugin, specifically versions

CVE-2026-66443 WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

PT-2026-71555

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

CVE-2026-66443: Insertion of Sensitive Information Into Sent Data

Unauthenticated Sensitive Data Exposure in REST API Log = 1.7.1 versions...

WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Aydan Arabadzha in WordPress Plugin REST API Log versions = 1.7.1...

CVE-2026-48083

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the /api/log endpoint accepts unauthenticated POST requests, applies no schema validation to the message body, writes attacker-controlled content directly into the...

EUVD-2026-54156

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the /api/log endpoint accepts unauthenticated POST requests, applies no schema validation to the message body, writes attacker-controlled content directly into the...

CVE-2026-48083: Improper Output Neutralization for Logs

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the /api/log endpoint accepts unauthenticated POST requests, applies no schema validation to the message body, writes attacker-controlled content directly into the...

CVE-2026-16547

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

EUVD-2026-52600

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

CVE-2026-16547: Improper Access Control

The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests a...

Python package "zhmcclient" stores passwords in clear text in its HMC and API logs

ImpactThe Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: The 'boot-ftp-password' and 'ssc-master-pw' properties when creating or updating a partition in DPM mode, in the zhmcclient API and HMC logs The 'ssc-master-pw' an...