CVE-2023-3350

CVE-2023-3349 / CVE-2023-3350 | IBERMATICA RPS 2019 Investigación de seguridad que documenta una divulgación de información no autenticada y una falla de diseño criptográfico en IBERMATICA RPS 2019. Las vulnerabilidades pueden encadenarse para exponer registros de aplicación que contienen consult...

All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87. id: CVE-2024-8852 info: name: All-in-One WP Migration 7.87 - Unauthenticated Information Disclosure...

W3 Total Cache < 2.8.2 - Log File Exposure

The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF...

CVE-2024-44000

ES GenCookieSessionHijack es una herramienta PoC diseñada para explotar registros de depuración expuestos de forma insegura en sitios WordPress y extraer cookies de sesión. Esto permite al atacante secuestrar sesiones activas de administrador y obtener acceso no autorizado al panel de...

CVE-2025-67223

CVE-2025-67223: Control de Acceso Incorrecto y Divulgación de Información en Aranda Service Desk CVE ID: CVE-2025-67223 Producto Afectado: Aranda Service Desk módulo Aranda File Server - AFS Versiones Afectadas: 8.3.12 Autor: Brandon Perez Lara 🚨 Resumen Se identificó una vulnerabilidad crítica e...

EUVD-2026-84862

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data. Attackers who obtain diagnostic archives can recover unrotated keys and replay them in forged deep links to submit agent requests without local confirmation...

CVE-2026-77407

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those...

CVE-2026-77407 RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those...

CVE-2026-77407 RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those...

CVE-2026-82437

Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...

CVE-2026-82434

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

CVE-2026-82434 Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

CVE-2026-82437 Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer

Description The Logviewer offers logs.users and logs.groups so operators can control who may read log content. For daemon logs those settings were not applied: the access decision combined the "this is a daemon log" flag with the authorizer result in a way that discarded the authorizer's answer...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible’s amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to exploit the issue, as the module handles the parameter insecurely, resulting in the password being leaked in the logs...

PT-2026-91230

Description When ZooKeeper authentication is configured, Storm deliberately retains storm.zookeeper.topology.auth.payload in the topology configuration, because workers need it. Nimbus then served that configuration verbatim to any caller holding read-only topology permissions, so a user whose on...

UBUNTU-CVE-2026-89444

In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump attribute security buffer setattribute populates the security area of the BIOS attribute request buffer with the current admin password via populatesecuritybuffer, then dumps the whol...

BIT-TOMCAT-2026-34487 Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0 through 11.0.20, from 10.1.0 through 10.1.53, from 9.0.13 through 9.0.116. Users are...

CVE-2026-87993

The consul-template library is vulnerable to an information disclosure issue in its error handling path that may allow Vault secret values to appear in template error messages, log output, and downstream surfaces such as Nomad task events. This vulnerability CVE-2026-87993 is fixed in...

CVE-2026-88897

Flextype CMS versions up to 1.0.0-alpha.3 transmit API authentication credentials via URL query string parameters in REST API routes. Because query strings are commonly logged, an attacker with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API a...

CVE-2026-88873 WWBN AVideo Cross-Site Request Forgery via logArchive.json.php

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.json.php that allows unauthenticated attackers to archive application logs by making GET requests without CSRF token validation. Attackers can craft malicious...