CVE-2026-71959

Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log...

CVE-2026-71959

Bitwarden Server prior to 2026.7.2 is vulnerable: the service does not verify that the caller belongs to the organization in a POST /collect request, permitting an authenticated user to forge and backdate entries in any organization’s audit log. The issue affects the audit-log integrity and can u...

CVE-2026-71959: Missing Authorization

Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authenticated user to write forged, arbitrarily backdated entries into any organization's audit log...

PT-2026-69846

Name of the Vulnerable Software and Affected Versions Bitwarden Server versions prior to 2026.7.2 Description An issue exists where the server fails to verify if the caller is a member of the organization specified in the request body of the 'POST /collect' endpoint. This allows any authenticated...

SUSE CVE-2026-46358

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to...

EUVD-2026-54653

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to...

CVE-2026-46358: Insertion of Sensitive Information into Log File

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to...

CVE-2026-59675 Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...

CVE-2026-59675 Rancher Audit-Log Middleware Unauthenticated Memory Exhaustion Denial of Service

When API audit logging is enabled, the middleware reads the entire HTTP request body into memory without enforcing a size limit on login endpoints. Because the audit middleware is positioned earlier in the handler chain than Rancher's APIBodyLimitingHandler, the body-size cap default 1 MiB is...

github.com/go-chi/chi: go-chi/chi: IP Spoofing via RealIP Middleware allows bypassing access controls

A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...

📄 OpenClaw Dashboard 3.0.0 Cross Site Scripting

OpenClaw Dashboard version 3.0.0 suffers from a persistent cross site scripting vulnerability in the Failed Login Username Field. Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS...

CVE-2026-65311

The HTTP server component of ANDRITZ HIPASE-250 formerly 250 SCALA in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network access to the service may suppress audit...

EUVD-2026-51501

The HTTP server component of ANDRITZ HIPASE-250 formerly 250 SCALA in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network access to the service may suppress audit...

CVE-2026-66418

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

CVE-2026-66418 OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

CVE-2026-66418

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

CVE-2026-66418

OpenClaw Dashboard v3.0.0 is affected by a stored XSS in the login failure path. An unauthenticated attacker can submit a crafted username, which is recorded in the audit log and later rendered unescaped via innerHTML in the administrator notification panel. The permissive CSP (allowing inline ev...

EUVD-2026-51309

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

SUSE CVE-2026-47726

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 - handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...

CVE-2026-66418: Improper Neutralization of Input During Web Page Generation

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...