CVE-2026-95699

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can expose other users' device data and allow the attacker to start and stop other connected users' devices. This risked exposing user profile information and...

CVE-2026-14442

An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters including external server passwords and...

CVE-2026-14442 Information exposure vulnerability in the job scheduling component of SANnav before 3.0.1a

An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters including external server passwords and...

CVE-2026-82372

Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the...

EUVD-2026-86408

Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the...

CVE-2026-82372 Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.a

Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the...

CVE-2026-82372

Brocade SANnav versions prior to 3.0.1a are vulnerable to improper handling of sensitive data during IPsec policy creation and modification. This flaw causes pre-shared keys to be recorded in application logs, potentially exposing credentials used to secure network tunnels to individuals with rea...

CVE-2026-82372 Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.a

Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the...

CVE-2026-57178

A flaw was found in social-auth-core. The VK application backend accepts callback data without verifying its cryptographic signature when the authentication key parameter is omitted. A remote attacker can exploit this vulnerability by submitting crafted callback requests with forged identity...

SUSE CVE-2026-88340

An invalid pointer release vulnerability exists in YARA 4.5.8 during deserialization of compiled .yrc rule files. The vulnerability is caused by insufficient validation of external-variable pointers, which may lead to invalid free in yrrulesdestroy or wild pointer access in yrobjectcreate. An...

CVE-2026-94613

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling...

CVE-2026-12559 Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application

A Stored Cross-Site Scripting XSS vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting...

CVE-2026-12559 Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application

A Stored Cross-Site Scripting XSS vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under certain conditions, this issue could allow execution of unauthorized script content in a user's browser, potentially impacting...

CVE-2026-12559

A Stored Cross-Site Scripting (XSS) vulnerability exists in the OpenText Vendor Invoice Management for SAP Solutions Capture Validation application. Under specific conditions, this flaw allows for the execution of unauthorized script content within a user's browser. This could potentially comprom...

xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in xdgmimemagicparsemagicline in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location e.g., in the $XDGDATAHOME/mime/magic path is parsed by an...

CVE-2026-82372: Insertion of Sensitive Information into Log File

Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the...

CVE-2026-14442: Insertion of Sensitive Information into Log File

An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be written to application logs in plain text. When scheduled support save jobs or related operational tasks are executed, sensitive parameters including external server passwords and...

Oracle E-Business Suite (September 2026 CSPU)

The versions of Oracle E-Business Suite installed on the remote host are affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Personalization. Supported versions...

PT-2026-98141

Name of the Vulnerable Software and Affected Versions SumatraPDF versions prior to 3.6 Description The MobiDoc::ParseHeader function in src/MobiDoc.cpp validates records using kMobiHeaderMinLen, while DecodeMobiDocHeader creates a decoder sized for kMobiHeaderLen without verifying the actual...

PT-2026-98254

Name of the Vulnerable Software and Affected Versions Brocade SANnav versions prior to 3.0.1a Description Improper handling of sensitive data during the creation and modification of IPsec policies causes pre-shared keys to be recorded in application logs. Users with read access to system log file...