27030 matches found
CVE-2026-24907 October CMS has Stored XSS via Event Log Mail Preview
October is a Content Management System CMS and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting XSS vulnerability in the Event Log mail preview feature. When viewing logged mail messages, HTML content was rendered in an iframe without proper sandboxing,...
CVE-2026-32070 Windows Common Log File System Driver Elevation of Privilege Vulnerability
...
CVE-2026-32070 Windows Common Log File System Driver Elevation of Privilege Vulnerability
...
CVE-2026-32070
CVE-2026-32070 affects Windows where the Common Log File System Driver contains an elevation-of-privilege flaw. The root cause is not explicitly described in the provided text, but the CVSS 3.1 metrics indicate a local attack vector with high impact on confidentiality, integrity, and availability...
CVE-2026-32218
Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally...
CVE-2026-32215
Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally...
CVE-2026-2404
CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an attacker alters the POST /jsecurity check request payload...
CVE-2026-2401
CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user executes a malicious file provided by an attacker...
CVE-2026-2403
CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a Web Admin user alters the POST /logsettings request payload...
CVE-2026-2401
CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user executes a malicious file provided by an attacker...
CVE-2026-2401
CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user executes a malicious file provided by an attacker...
CVE-2026-2401
Technical details for CVE-2026-2401 are not publicly available in the provided documents; monitor for updates.
CVE-2026-2403
CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a Web Admin user alters the POST /logsettings request payload...
CVE-2026-2403
CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a Web Admin user alters the POST /logsettings request payload...
CVE-2026-2403
The CVE describes an input validation flaw (CWE-1284) where improper validation of a specified quantity in the POST /logsettings payload by a Web Admin user can lead to Event and Data Log truncation, compromising log integrity. Exploitation details are not provided beyond the admin payload manipu...
CVE-2026-2404
CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an attacker alters the POST /jsecurity check request payload...
CVE-2026-2404
CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an attacker alters the POST /jsecurity check request payload...
CVE-2026-2404
CVE-2026-2404 describes an input handling flaw (CWE-116) where improper encoding/escaping of output can lead to log injection and forged logs when an attacker alters the POST /j_security check request payload. The description confirms a network-exposed vector (AV:N) with no user interaction requi...
