32696 matches found
PT-2026-79950
Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...
PT-2026-79925
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if...
CVE-2026-44256: Improper Output Neutralization for Logs
Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.4.0 until 4.14.6 and 5.0.0-beta2, api/api/middlewares.py decodes the Basic authentication username before credential validation and passes it to the access logger without neutralizing control...
CVE-2026-75900: Out-of-bounds Read
An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is a pointer, instead of sizeofbh, the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overre...
CVE-2026-76375: Insertion of Sensitive Information into Log File
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more...
CVE-2026-76374: Insertion of Sensitive Information into Log File
In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an acti...
CVE-2026-76920: Out-of-bounds Write
3gpp phone log file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
SUSE SLED15 / SLES15 Security Update : go1.25 (SUSE-SU-2026:3640-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3640-1 advisory. Security issues fixed: - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. -...
CVE-2026-72817
A flaw was found in the go-chi/chi component. The RealIP middleware, responsible for resolving the request source IP, does not properly validate trusted proxies when processing the X-Forwarded-For header. A remote attacker can exploit this by prepending a forged IP address to the X-Forwarded-For...
GHSA-4H97-P9WQ-CHQJ Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requireskey: branch. When the selected export plugin advertises requireskey = False, the authorization check is skipped entirely and any authenticated...
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Summary The CertificateExport handler in lemur/certificates/views.py nests its entire ownership / CertificatePermission check inside an if plugin.requireskey: branch. When the selected export plugin advertises requireskey = False, the authorization check is skipped entirely and any authenticated...
CVE-2026-71322 Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requireskey branch for POST /api/1/certificates//export. A plugin declaring requireskey false bypassed that check, and the handler still passed...
CVE-2026-71322 Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requireskey branch for POST /api/1/certificates//export. A plugin declaring requireskey false bypassed that check, and the handler still passed...
EUVD-2026-61158
Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requireskey branch for POST /api/1/certificates//export. A plugin declaring requireskey false bypassed that check, and the handler still passed...
CVE-2026-71322
Lemur (Netflix's TLS certificate management platform) prior to 1.9.3 contains an authorization bypass in the CertificateExport handler (lemur/certificates/views.py). The CertificatePermission ownership check is structurally nested inside an if plugin.requires_key: branch, so any export plugin dec...
CVE-2026-72815
A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries...
Important: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.5.2
Logging for Red Hat OpenShift - 6.5.2 Red Hat OpenShift Logging 6.5.2 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs...
GO-2026-6093 AWS CDK CodeBuild S3 Log Encryption Boolean Inversion in github.com/aws/aws-cdk-go/awscdk
AWS CDK CodeBuild S3 Log Encryption Boolean Inversion in github.com/aws/aws-cdk-go/awscdk...
pii-shield v2.2.0
PII-Shield š”ļø Zero-code log sanitization sidecar for Kubernetes. Prevents data leaks GDPR/SOC2 by redacting PII from logs before they leave the pod. PII-Shield runs in-process ā CLI, sidecar, or WASM. There is no hosted API and no server your data is sent to. "Don't let PII poison your AI models."...
CVE-2026-72816
A flaw was found in the go-chi/chi RealIP middleware. This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. This can lead to bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and...