EUVD-2026-35424

A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the createmaskedentrystring function in auditlog.c copies a fixed-length password mask into a precisely-sized heap buffer without checking available space. If a short cleartext password is logged requiri...

CVE-2026-11792 389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string)

A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the createmaskedentrystring function in auditlog.c copies a fixed-length password mask into a precisely-sized heap buffer without checking available space. If a short cleartext password is logged requiri...

CVE-2026-49742

Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer FAL via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This...

CVE-2026-41977

DoS vulnerability in the log service. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-41977

DoS vulnerability in the log service. Impact: Successful exploitation of this vulnerability may affect availability...

EUVD-2026-35363

DoS vulnerability in the log service. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-41977

DoS vulnerability in the log service. Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2026-41977

Technical details about CVE-2026-41977 are not publicly available in the provided documents. Monitor for updates from trusted sources.

PT-2026-47925

Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally...

PT-2026-47696

DoS vulnerability in the log service. Impact: Successful exploitation of this vulnerability may affect availability...

PT-2026-47749

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 11.0.0 through 11.5.50 TYPO3 CMS versions 12.0.0 through 12.4.45 TYPO3 CMS versions 13.0.0 through 13.4.30 TYPO3 CMS versions 14.0.0 through 14.3.2 Description Backend users with file download permissions can download files...

PT-2026-48301

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description The ldapQueryPassword parameter, when configured using the runtime setParameter command, causes the new password to be recorded in plain text within the mongod.log file. Recommendations At th...

TYPO3 CMS 路径遍历漏洞

TYPO3 CMS is a content management system developed under the TYPO3 open source framework. Versions 11.0.0 to 11.5.50, 12.0.0 to 12.4.45, 13.0.0 to 13.4.30, and 14.0.0 to 14.3.2 of TYPO3 CMS contain a path traversal vulnerability. This vulnerability arises from backend users with file download...

Huawei EMUI和Huawei HarmonyOS 输入验证错误漏洞

Huawei HarmonyOS EMUI is a microkernel-based distributed operating system developed by Huawei, offering seamless collaboration across devices. There are input validation vulnerabilities in Huawei EMUI and Huawei HarmonyOS. These vulnerabilities stem from the log service’s failure to properly hand...

MongoDB Server 日志信息泄露漏洞

MongoDB Server is an open-source NoSQL database developed by MongoDB, a US-based company. This database offers features such as collection-oriented storage, dynamic querying, data replication, and automatic failover. There is a vulnerability in MongoDB Server where log information may be leaked...

MongoDB Server 日志信息泄露漏洞

MongoDB Server is an open-source NoSQL database developed by MongoDB, a company based in the United States. This database offers features such as collection-oriented storage, dynamic querying, data replication, and automatic failover. There is a vulnerability in MongoDB Server related to log...

microsoft windows common log file system driver 资源管理错误漏洞

The Microsoft Windows Common Log File System Driver provides a high-performance, general-purpose log file subsystem. Dedicated client applications can utilize this subsystem, and multiple clients can share it to optimize log access. The Microsoft Windows Common Log File System Driver has a resour...

Linux Distros Unpatched Vulnerability : CVE-2026-11792

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the createmaskedentrystring function in auditlog.c copies a...

GHSA-QM33-P5P9-F8VG nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to limit=1000. This includes cross-tenant actor names, host/CA/operator IDs, action timestamps, and masked-IP entrie...

nebula-mesh: GET /api/v1/audit-log discloses all entries to any operator

internal/api/audit.go:12 — handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to limit=1000. This includes cross-tenant actor names, host/CA/operator IDs, action timestamps, and masked-IP entrie...