CVE-2026-92810

PrestaShop blockwishlist module through version 3.0.2 contains an Insecure Direct Object Reference (IDOR) in the getUrlByIdWishListAction method. The module fails to validate wishlist ownership, so any authenticated customer can supply sequential wishlist identifiers to retrieve valid share token...

CVE-2026-92760

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens. Attackers holding restricted keys (author-only or domain-only) can access the mercure-info endpoint and receive visit data—including referrer, user agent, geolocation, and full short URL obje...

CVE-2026-92760 Shlink through 5.1.6 Mercure Token Authorization Bypass

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent,...

EUVD-2026-81028

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent,...

CVE-2026-92760 Shlink through 5.1.6 Mercure Token Authorization Bypass

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent,...

CVE-2026-92760 Shlink through 5.1.6 Mercure Token Authorization Bypass

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscribe to all topics. Attackers with author-only or domain-only keys can access the mercure-info endpoint to receive visit data including referrer, user agent,...

CVE-2026-92759 SecObserve before 1.59.1 Information Disclosure via API Configuration

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basicauthpassword field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or...

CVE-2026-76426 Cisco ISE REST API SQL Injection Vulnerability

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct SQL injection attacks against the monitoring database. This vulnerability is due to insufficient validation of specific parameters that are then concatenated into an SQL...

EUVD-2026-81152

A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to retrieve sensitive configuration information from an affected device. This vulnerability is due to missing authentication on the Policy Runtime Repository Table PRRT service. A...

AZL-103176 CVE-2026-81870 affecting package kata-containers-cc 3.15.0.aks0-21

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

AZL-103164 CVE-2026-81870 affecting package etcd 3.5.33-1

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

AZL-103200 CVE-2026-81870 affecting package keda 2.14.1-19

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

AZL-103173 CVE-2026-81870 affecting package kata-containers 4.1.0.kata0-1

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

AZL-103236 CVE-2026-81870 affecting package moby-containerd-cc 1.7.7-17

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

AZL-103052 CVE-2026-81870 affecting package azl-otel-collector 0.127.0-1

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

CVE-2026-81870

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

AZL-103242 CVE-2026-81870 affecting package moby-engine 25.0.3-20

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

DEBIAN-CVE-2026-81870

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

CVE-2026-89471

creationtimestamp| type| source ---|---|--- 2026-09-16 20:10:22+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117282531039531068 2026-09-16 20:20:05+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mvnxmcddep2p...

CVE-2026-91106

creationtimestamp| type| source ---|---|--- 2026-09-16 20:08:29+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mvnwxl7ote2w 2026-09-16 20:10:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvnx2jtoad2t 2026-09-22 06:00:04+00:00| seen|...